title: MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive
description: MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12
problem types: CWE-497 Exposure of System Data to an Unauthorized Control Sphere
affected:
{
defaultStatus: unaffected
product: MongoDB Ops Manager
vendor: MongoDB Inc.
versions:
lessThan: 5.0.21, status: affected, version: v5.0, versionType: custom
lessThan: 6.0.12 , status: affected, version: v6.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL