Lucene search

MongoDBMONGODB:CVE-2024-3371

HistoryApr 24, 2024 - 4:32 p.m.

Insufficient validation of external input in Compass may enable MITM attacks

2024-04-2416:32:00

www.mongodb.com

mongodb

compass

mitm

validation

attacks

version 1.35.0

version 1.40.5

data disclosure

application behavior

untrusted source

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

AI Score

6.9

Confidence

High

EPSS

Percentile

9.0%

JSON

MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.40.5.

References

jira.mongodb.org/browse/COMPASS-7260

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

AI Score

6.9

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for MONGODB:CVE-2024-3371