ejson shell parser in MongoDB Compass maybe bypassed (MongoDB Inc MongoDB Compass)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.48 % · percentile 41 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mongodb
- NVD status
- Modified
Description
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.0 | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | mongodb |
| CVSS 3.1 | HIGH 7.0 | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · cna@mongodb.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-jxr4-4prv-mh83 — ejson shell parser in MongoDB Compass maybe bypassed
European references
- ENISA EUVD · EUVD-2024-47483
- GCVE · GCVE-0-2024-6376
CERT-FR advisories
- CERTFR-2024-AVI-0537 — Multiples vulnérabilités dans MongoDB · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:mongodb:compass:*:*:*:*:*:*:*:*< 1.42.2
Affected products
| Product | Versions |
|---|---|
| MongoDB Inc · MongoDB Compass | affected 0 < 1.42.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |