CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
AI Score
Confidence
Low
SSVC
Exploitation
none
Automatable
no
Technical Impact
total
MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.
[
{
"cpes": [
"cpe:2.3:a:mongodb:compass:1.35.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.36.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.36.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.36.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.36.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.37.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.38.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.38.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.38.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.39.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.39.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.39.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.39.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.39.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.40.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.40.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.40.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.40.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.40.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:compass:1.42.0:*:*:*:*:*:*:*"
],
"vendor": "MongoDB Inc",
"product": "MongoDB Compass",
"versions": [
{
"status": "affected",
"version": "1.35.0",
"versionType": "custom",
"lessThanOrEqual": "1.42.0"
}
],
"defaultStatus": "unaffected"
}
]
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
AI Score
Confidence
Low
SSVC
Exploitation
none
Automatable
no
Technical Impact
total