Lucene search

K
vulnrichmentMongodbVULNRICHMENT:CVE-2024-3371
HistoryApr 24, 2024 - 4:32 p.m.

CVE-2024-3371 Insufficient validation of external input in Compass may enable MITM attacks

2024-04-2416:32:07
CWE-360
mongodb
github.com
2
cve-2024-3371
compass
mitm attacks
untrusted external source
data disclosure
impersonate users
version 1.35.0
version 1.42.0

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

AI Score

7

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.

CNA Affected

[
  {
    "cpes": [
      "cpe:2.3:a:mongodb:compass:1.35.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.36.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.36.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.36.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.36.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.37.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.38.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.38.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.38.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.39.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.39.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.39.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.39.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.39.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.40.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.40.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.40.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.40.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.40.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:mongodb:compass:1.42.0:*:*:*:*:*:*:*"
    ],
    "vendor": "MongoDB Inc",
    "product": "MongoDB Compass",
    "versions": [
      {
        "status": "affected",
        "version": "1.35.0",
        "versionType": "custom",
        "lessThanOrEqual": "1.42.0"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

AI Score

7

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

Related for VULNRICHMENT:CVE-2024-3371