Lucene search

[email protected]CVE-2024-6376

HistoryJul 01, 2024 - 3:15 p.m.

CVE-2024-6376

2024-07-0115:15:17

CWE-20

CWE-94

[email protected]

web.nvd.nist.gov

mongodb compass

code injection

vulnerability

version 1.42.2

ejson shell parser

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.2%

JSON

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass’ connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2

Affected configurations

NVD

Node

mongodbcompassRange<1.42.2

CPENameOperatorVersion
mongodb:compassmongodb compasslt1.42.2

CPE	Name	Operator	Version
mongodb:compass	mongodb compass	lt	1.42.2

CNA Affected

[
  {
    "cpes": [
      "cpe:2.3:a:mongodb:compass:1.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.6:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.7:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.8:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.9:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.10:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.11:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.12:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.13:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.14:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.15:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.16:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.17:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.18:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.19:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.20:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.21:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.22:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.23:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.24.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.25.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.26.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.26.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.28.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.28.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.29.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.29.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.29.6:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.30.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.31.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.31.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.31.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.31.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.32.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.32.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.32.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.32.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.33.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.33.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.34.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.34.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.35.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.36.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.36.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.37.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.38.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.38.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.38.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.39.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.39.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.39.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.39.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.39.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.40.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.40.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.40.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.40.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.40.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.41.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.42.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.42.1:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "MongoDB Compass",
    "vendor": "MongoDB Inc",
    "versions": [
      {
        "lessThan": "1.42.2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

jira.mongodb.org/browse/COMPASS-7496

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for CVE-2024-6376

nvd1 mongodb1 vulnrichment1 cvelist1