Insufficient validation of external input in Compass may enable MITM attacks (MongoDB Inc MongoDB Compass)
En bref
- Source
- NVD
- EPSS
- EPSS 0.23 % · centile 14 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mongodb
- Statut NVD
- Analyzed
Rechercher sur…
Description
MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.
Faiblesses (CWE)
- CWE-360 — Trust of System Event Data
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L | mongodb |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L | NVD · cna@mongodb.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-31960
- GCVE · GCVE-0-2024-3371
Avis du CERT-FR
- CERTFR-2024-AVI-0348 — Vulnérabilité dans les produits MongoDB · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:mongodb:compass:*:*:*:*:*:*:*:*≥ 1.35.0 < 1.42.1
Produits affectés
| Produit | Versions |
|---|---|
| MongoDB Inc · MongoDB Compass | affected 1.35.0 ≤ 1.42.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |