The vulnerability allows an attacker who can execute the runtime setParameter command to set ldapQueryPassword, resulting in the new password being written in plain text to mongod.log. This disclosure of credentials jeopardizes confidentiality.

MongoDB Server is affected. No specific version information is provided, so all installations that could accept the runtime setParameter command and log ldapQueryPassword are potentially impacted.

The CVSS score of 6.8 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require the ability to issue runtime setParameter commands, which typically implies privileged access or an exposed administrative interface. Once exploited, the attacker can read the log file to access plaintext passwords.