MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128433)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(331215);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/30");

  script_cve_id(
    "CVE-2026-9737",
    "CVE-2026-13055",
    "CVE-2026-13059",
    "CVE-2026-13060",
    "CVE-2026-13062",
    "CVE-2026-13065",
    "CVE-2026-13066",
    "CVE-2026-13068",
    "CVE-2026-13069",
    "CVE-2026-13070",
    "CVE-2026-13071",
    "CVE-2026-13072",
    "CVE-2026-13074",
    "CVE-2026-13077",
    "CVE-2026-13078"
  );

  script_name(english:"MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128433)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, 8.2.x prior to
8.2.12, or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities:

  - An authenticated user with low privileges may be able to perform unauthorized reads and writes on data
    protected by role-based query-level access controls, due to insufficient validation of certain
    client-supplied command parameters. (CVE-2026-13059)

  - When compute mode is enabled on a standalone mongod instance, insufficient validation of externally
    sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially
    leading to process termination or other unintended behavior. (CVE-2026-13072)

  - A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an
    out-of-bounds heap read via a crafted aggregation pipeline, causing either a server crash or disclosure
    of adjacent heap memory contents. (CVE-2026-13077)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jira.mongodb.org/browse/SERVER-128433");
  script_set_attribute(attribute:"solution", value:
"Upgrade to MongoDB version 7.0.39 / 8.0.28 / 8.2.12 / 8.3.7 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-13059");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/30");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mongodb:mongodb");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("mongodb_win_installed.nbin", "mongodb_nix_installed.nbin", "mongodb_macos_installed.nbin", "mongodb_detect.nasl");
  script_require_keys("installed_sw/MongoDB");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'MongoDB', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        {'min_version':'7.0.0', 'fixed_version':'7.0.39'},
        {'min_version':'8.0.0', 'fixed_version':'8.0.28'},
        {'min_version':'8.2.0', 'fixed_version':'8.2.12'},
        {'min_version':'8.3.0', 'fixed_version':'8.3.7'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);