cvelistv5 - cve-2024-6376

CVE-2024-6376 (GCVE-0-2024-6376)

Vulnerability from cvelistv5 – Published: 2024-07-01 14:57 – Updated: 2024-08-01 21:33

Summary

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2

Severity ?

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-20 - Improper Input Validation

Assigner

mongodb

References

URL

Tags

https://jira.mongodb.org/browse/COMPASS-7496

Impacted products

	Vendor	Product	Version
	MongoDB Inc	MongoDB Compass	Affected: 0 , < 1.42.2 (custom) cpe:2.3:a:mongodb:compass:1.0:::::::* cpe:2.3:a:mongodb:compass:1.1:::::::* cpe:2.3:a:mongodb:compass:1.2:::::::* cpe:2.3:a:mongodb:compass:1.3:::::::* cpe:2.3:a:mongodb:compass:1.4:::::::* cpe:2.3:a:mongodb:compass:1.5:::::::* cpe:2.3:a:mongodb:compass:1.6:::::::* cpe:2.3:a:mongodb:compass:1.7:::::::* cpe:2.3:a:mongodb:compass:1.8:::::::* cpe:2.3:a:mongodb:compass:1.9:::::::* cpe:2.3:a:mongodb:compass:1.10:::::::* cpe:2.3:a:mongodb:compass:1.11:::::::* cpe:2.3:a:mongodb:compass:1.12:::::::* cpe:2.3:a:mongodb:compass:1.13:::::::* cpe:2.3:a:mongodb:compass:1.14:::::::* cpe:2.3:a:mongodb:compass:1.15:::::::* cpe:2.3:a:mongodb:compass:1.16:::::::* cpe:2.3:a:mongodb:compass:1.17:::::::* cpe:2.3:a:mongodb:compass:1.18:::::::* cpe:2.3:a:mongodb:compass:1.19:::::::* cpe:2.3:a:mongodb:compass:1.20:::::::* cpe:2.3:a:mongodb:compass:1.21:::::::* cpe:2.3:a:mongodb:compass:1.22:::::::* cpe:2.3:a:mongodb:compass:1.23:::::::* cpe:2.3:a:mongodb:compass:1.24.1:::::::* cpe:2.3:a:mongodb:compass:1.25.0:::::::* cpe:2.3:a:mongodb:compass:1.26.0:::::::* cpe:2.3:a:mongodb:compass:1.26.1:::::::* cpe:2.3:a:mongodb:compass:1.28.1:::::::* cpe:2.3:a:mongodb:compass:1.28.4:::::::* cpe:2.3:a:mongodb:compass:1.29.4:::::::* cpe:2.3:a:mongodb:compass:1.29.5:::::::* cpe:2.3:a:mongodb:compass:1.29.6:::::::* cpe:2.3:a:mongodb:compass:1.30.1:::::::* cpe:2.3:a:mongodb:compass:1.31.0:::::::* cpe:2.3:a:mongodb:compass:1.31.1:::::::* cpe:2.3:a:mongodb:compass:1.31.2:::::::* cpe:2.3:a:mongodb:compass:1.31.3:::::::* cpe:2.3:a:mongodb:compass:1.32.0:::::::* cpe:2.3:a:mongodb:compass:1.32.1:::::::* cpe:2.3:a:mongodb:compass:1.32.2:::::::* cpe:2.3:a:mongodb:compass:1.32.3:::::::* cpe:2.3:a:mongodb:compass:1.33.0:::::::* cpe:2.3:a:mongodb:compass:1.33.1:::::::* cpe:2.3:a:mongodb:compass:1.34.1:::::::* cpe:2.3:a:mongodb:compass:1.34.2:::::::* cpe:2.3:a:mongodb:compass:1.35.0:::::::* cpe:2.3:a:mongodb:compass:1.36.0:::::::* cpe:2.3:a:mongodb:compass:1.36.2:::::::* cpe:2.3:a:mongodb:compass:1.37.0:::::::* cpe:2.3:a:mongodb:compass:1.38.0:::::::* cpe:2.3:a:mongodb:compass:1.38.1:::::::* cpe:2.3:a:mongodb:compass:1.38.2:::::::* cpe:2.3:a:mongodb:compass:1.39.0:::::::* cpe:2.3:a:mongodb:compass:1.39.1:::::::* cpe:2.3:a:mongodb:compass:1.39.2:::::::* cpe:2.3:a:mongodb:compass:1.39.3:::::::* cpe:2.3:a:mongodb:compass:1.39.4:::::::* cpe:2.3:a:mongodb:compass:1.40.0:::::::* cpe:2.3:a:mongodb:compass:1.40.1:::::::* cpe:2.3:a:mongodb:compass:1.40.2:::::::* cpe:2.3:a:mongodb:compass:1.40.3:::::::* cpe:2.3:a:mongodb:compass:1.40.4:::::::* cpe:2.3:a:mongodb:compass:1.41.0:::::::* cpe:2.3:a:mongodb:compass:1.42.0:::::::* cpe:2.3:a:mongodb:compass:1.42.1:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6376",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-01T20:45:03.494038Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-01T20:45:10.830Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:33:05.431Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jira.mongodb.org/browse/COMPASS-7496"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:mongodb:compass:1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.14:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.15:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.16:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.17:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.18:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.19:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.20:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.21:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.22:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.23:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.24.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.25.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.26.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.26.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.28.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.28.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.29.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.29.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.29.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.30.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.31.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.31.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.31.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.31.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.32.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.32.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.32.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.32.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.33.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.33.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.34.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.34.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.35.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.36.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.36.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.37.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.38.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.38.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.38.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.39.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.39.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.39.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.39.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.39.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.40.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.40.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.40.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.40.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.40.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.41.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.42.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:compass:1.42.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "MongoDB Compass",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThan": "1.42.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-07-01T14:56:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eMongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass\u0027 connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass\u0027 connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-01T14:57:31.704Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/COMPASS-7496"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ejson shell parser in MongoDB Compass maybe bypassed",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2024-6376",
    "datePublished": "2024-07-01T14:57:31.704Z",
    "dateReserved": "2024-06-27T07:55:22.098Z",
    "dateUpdated": "2024-08-01T21:33:05.431Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mongodb:compass:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.42.2\", \"matchCriteriaId\": \"2C0CC548-DDB4-4527-AEBC-1993B3E39EDA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass\u0027 connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2\"}, {\"lang\": \"es\", \"value\": \"MongoDB Compass puede ser susceptible a la inyecci\\u00f3n de c\\u00f3digo debido a una configuraci\\u00f3n insuficiente de protecci\\u00f3n de la zona de pruebas con el uso del analizador de shell ejson en el manejo de conexiones de Compass. Este problema afecta a las versiones de MongoDB Compass anteriores a la versi\\u00f3n 1.42.2\"}]",
      "id": "CVE-2024-6376",
      "lastModified": "2024-11-21T09:49:31.510",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"cna@mongodb.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 7.0, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2024-07-01T15:15:17.673",
      "references": "[{\"url\": \"https://jira.mongodb.org/browse/COMPASS-7496\", \"source\": \"cna@mongodb.com\", \"tags\": [\"Issue Tracking\", \"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://jira.mongodb.org/browse/COMPASS-7496\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Patch\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "cna@mongodb.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"cna@mongodb.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-94\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-6376\",\"sourceIdentifier\":\"cna@mongodb.com\",\"published\":\"2024-07-01T15:15:17.673\",\"lastModified\":\"2024-11-21T09:49:31.510\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass\u0027 connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2\"},{\"lang\":\"es\",\"value\":\"MongoDB Compass puede ser susceptible a la inyecci\u00f3n de c\u00f3digo debido a una configuraci\u00f3n insuficiente de protecci\u00f3n de la zona de pruebas con el uso del analizador de shell ejson en el manejo de conexiones de Compass. Este problema afecta a las versiones de MongoDB Compass anteriores a la versi\u00f3n 1.42.2\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@mongodb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"cna@mongodb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mongodb:compass:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.42.2\",\"matchCriteriaId\":\"2C0CC548-DDB4-4527-AEBC-1993B3E39EDA\"}]}]}],\"references\":[{\"url\":\"https://jira.mongodb.org/browse/COMPASS-7496\",\"source\":\"cna@mongodb.com\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://jira.mongodb.org/browse/COMPASS-7496\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://jira.mongodb.org/browse/COMPASS-7496\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T21:33:05.431Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-6376\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-01T20:45:03.494038Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-01T20:45:07.675Z\"}}], \"cna\": {\"title\": \"ejson shell parser in MongoDB Compass maybe bypassed\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:mongodb:compass:1.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.8:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.9:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.10:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.11:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.12:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.13:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.14:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.15:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.16:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.17:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.18:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.19:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.20:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.21:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.22:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.23:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.24.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.25.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.26.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.26.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.28.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.28.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.29.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.29.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.29.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.30.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.31.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.31.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.31.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.31.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.32.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.32.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.32.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.32.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.33.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.33.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.34.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.34.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.35.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.36.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.36.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.37.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.38.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.38.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.38.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.39.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.39.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.39.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.39.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.39.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.40.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.40.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.40.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.40.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.40.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.41.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.42.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:compass:1.42.1:*:*:*:*:*:*:*\"], \"vendor\": \"MongoDB Inc\", \"product\": \"MongoDB Compass\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.42.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2024-07-01T14:56:00.000Z\", \"references\": [{\"url\": \"https://jira.mongodb.org/browse/COMPASS-7496\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass\u0027 connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eMongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass\u0027 connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2\u003c/span\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20: Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"a39b4221-9bd0-4244-95fc-f3e2e07f1deb\", \"shortName\": \"mongodb\", \"dateUpdated\": \"2024-07-01T14:57:31.704Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-6376\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T21:33:05.431Z\", \"dateReserved\": \"2024-06-27T07:55:22.098Z\", \"assignerOrgId\": \"a39b4221-9bd0-4244-95fc-f3e2e07f1deb\", \"datePublished\": \"2024-07-01T14:57:31.704Z\", \"assignerShortName\": \"mongodb\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-6376

Vulnerability from fkie_nvd - Published: 2024-07-01 15:15 - Updated: 2024-11-21 09:49

Severity ?

7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	cna@mongodb.com	https://jira.mongodb.org/browse/COMPASS-7496	Issue Tracking, Patch, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://jira.mongodb.org/browse/COMPASS-7496	Issue Tracking, Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	mongodb	compass	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mongodb:compass:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C0CC548-DDB4-4527-AEBC-1993B3E39EDA",
              "versionEndExcluding": "1.42.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass\u0027 connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2"
    },
    {
      "lang": "es",
      "value": "MongoDB Compass puede ser susceptible a la inyecci\u00f3n de c\u00f3digo debido a una configuraci\u00f3n insuficiente de protecci\u00f3n de la zona de pruebas con el uso del analizador de shell ejson en el manejo de conexiones de Compass. Este problema afecta a las versiones de MongoDB Compass anteriores a la versi\u00f3n 1.42.2"
    }
  ],
  "id": "CVE-2024-6376",
  "lastModified": "2024-11-21T09:49:31.510",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.9,
        "source": "cna@mongodb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-07-01T15:15:17.673",
  "references": [
    {
      "source": "cna@mongodb.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://jira.mongodb.org/browse/COMPASS-7496"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://jira.mongodb.org/browse/COMPASS-7496"
    }
  ],
  "sourceIdentifier": "cna@mongodb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "cna@mongodb.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CERTFR-2024-AVI-0537

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans MongoDB. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
MongoDB	Server	MongoDB Server versions 5.x antérieures à 5.0.22
MongoDB	Compass	MongoDB Compass versions antérieures à 1.42.2
MongoDB	Server	MongoDB Server versions 7.x antérieures à 7.0.3
MongoDB	N/A	libbson versions antérieures à 1.26.2
MongoDB	Server	MongoDB Server versions 6.x antérieures à 6.0.11
MongoDB	Rust Driver	MongoDB Rust Driver versions 2.x antérieures à 2.8.2

References

Title

Publication Time

Tags

Bulletin de sécurité MongoDB COMPASS-7496	2024-07-01	vendor-advisory
Bulletin de sécurité MongoDB CDRIVER-5622	2024-07-02	vendor-advisory
Bulletin de sécurité MongoDB SERVER-79327	2024-07-01	vendor-advisory
Bulletin de sécurité MongoDB RUST-1881	2024-07-02	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "MongoDB Server versions 5.x ant\u00e9rieures \u00e0 5.0.22",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB Compass versions ant\u00e9rieures \u00e0 1.42.2",
      "product": {
        "name": "Compass",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB Server versions 7.x ant\u00e9rieures \u00e0 7.0.3",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "libbson versions ant\u00e9rieures \u00e0 1.26.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB Server versions 6.x ant\u00e9rieures \u00e0 6.0.11",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB Rust Driver versions 2.x ant\u00e9rieures \u00e0 2.8.2",
      "product": {
        "name": "Rust Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-6382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6382"
    },
    {
      "name": "CVE-2024-6376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6376"
    },
    {
      "name": "CVE-2024-6375",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6375"
    },
    {
      "name": "CVE-2024-6381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6381"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0537",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans MongoDB. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans MongoDB",
  "vendor_advisories": [
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB COMPASS-7496",
      "url": "https://jira.mongodb.org/browse/COMPASS-7496"
    },
    {
      "published_at": "2024-07-02",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-5622",
      "url": "https://jira.mongodb.org/browse/CDRIVER-5622"
    },
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-79327",
      "url": "https://jira.mongodb.org/browse/SERVER-79327"
    },
    {
      "published_at": "2024-07-02",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB RUST-1881",
      "url": "https://jira.mongodb.org/browse/RUST-1881"
    }
  ]
}

CERTFR-2024-AVI-0537

Vulnerability from certfr_avis - Published: - Updated:

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
MongoDB	Server	MongoDB Server versions 5.x antérieures à 5.0.22
MongoDB	Compass	MongoDB Compass versions antérieures à 1.42.2
MongoDB	Server	MongoDB Server versions 7.x antérieures à 7.0.3
MongoDB	N/A	libbson versions antérieures à 1.26.2
MongoDB	Server	MongoDB Server versions 6.x antérieures à 6.0.11
MongoDB	Rust Driver	MongoDB Rust Driver versions 2.x antérieures à 2.8.2

References

Title

Publication Time

Tags

Bulletin de sécurité MongoDB COMPASS-7496	2024-07-01	vendor-advisory
Bulletin de sécurité MongoDB CDRIVER-5622	2024-07-02	vendor-advisory
Bulletin de sécurité MongoDB SERVER-79327	2024-07-01	vendor-advisory
Bulletin de sécurité MongoDB RUST-1881	2024-07-02	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "MongoDB Server versions 5.x ant\u00e9rieures \u00e0 5.0.22",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB Compass versions ant\u00e9rieures \u00e0 1.42.2",
      "product": {
        "name": "Compass",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB Server versions 7.x ant\u00e9rieures \u00e0 7.0.3",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "libbson versions ant\u00e9rieures \u00e0 1.26.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB Server versions 6.x ant\u00e9rieures \u00e0 6.0.11",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB Rust Driver versions 2.x ant\u00e9rieures \u00e0 2.8.2",
      "product": {
        "name": "Rust Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-6382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6382"
    },
    {
      "name": "CVE-2024-6376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6376"
    },
    {
      "name": "CVE-2024-6375",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6375"
    },
    {
      "name": "CVE-2024-6381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6381"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0537",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans MongoDB. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans MongoDB",
  "vendor_advisories": [
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB COMPASS-7496",
      "url": "https://jira.mongodb.org/browse/COMPASS-7496"
    },
    {
      "published_at": "2024-07-02",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-5622",
      "url": "https://jira.mongodb.org/browse/CDRIVER-5622"
    },
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-79327",
      "url": "https://jira.mongodb.org/browse/SERVER-79327"
    },
    {
      "published_at": "2024-07-02",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB RUST-1881",
      "url": "https://jira.mongodb.org/browse/RUST-1881"
    }
  ]
}

WID-SEC-W-2024-1490

Vulnerability from csaf_certbund - Published: 2024-07-01 22:00 - Updated: 2024-07-01 22:00

Summary

MongoDB Compass: Schwachstelle ermöglicht Codeausführung

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

MongoDB Compass ist eine grafische Benutzeroberfläche für den Zugriff auf MongoDB.

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in MongoDB Compass ausnutzen, um beliebigen Programmcode auszuführen.

Betroffene Betriebssysteme

- Linux - MacOS X - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "MongoDB Compass ist eine grafische Benutzeroberfl\u00e4che f\u00fcr den Zugriff auf MongoDB.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in MongoDB Compass ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1490 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1490.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1490 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1490"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2024-07-01",
        "url": "https://github.com/advisories/GHSA-jxr4-4prv-mh83"
      },
      {
        "category": "external",
        "summary": "Mongo DB Advisory vom 2024-07-01",
        "url": "https://jira.mongodb.org/browse/COMPASS-7496"
      }
    ],
    "source_lang": "en-US",
    "title": "MongoDB Compass: Schwachstelle erm\u00f6glicht Codeausf\u00fchrung",
    "tracking": {
      "current_release_date": "2024-07-01T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:10:46.184+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2024-1490",
      "initial_release_date": "2024-07-01T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-07-01T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.42.2",
                "product": {
                  "name": "Open Source MongoDB Compass \u003c1.42.2",
                  "product_id": "T035725"
                }
              }
            ],
            "category": "product_name",
            "name": "MongoDB Compass"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-6376",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in MongoDB Compass. Dieser Fehler besteht aufgrund einer unsachgem\u00e4\u00dfen Eingabevalidierung, die zu einem unzureichenden Sandbox-Schutz f\u00fchrt. Ein entfernter, anonymer Angreifer kann diese Schwachstelle zur Ausf\u00fchrung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "release_date": "2024-07-01T22:00:00.000+00:00",
      "title": "CVE-2024-6376"
    }
  ]
}

GHSA-JXR4-4PRV-MH83

Vulnerability from github – Published: 2024-07-01 15:32 – Updated: 2025-02-27 20:59

Summary

ejson shell parser in MongoDB Compass maybe bypassed

Details

Severity ?

7.0 (High)


                  
                    CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@mongodb-js/connection-form"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.20.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-6376"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-27T20:59:11Z",
    "nvd_published_at": "2024-07-01T15:15:17Z",
    "severity": "HIGH"
  },
  "details": "MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass\u0027 connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2.",
  "id": "GHSA-jxr4-4prv-mh83",
  "modified": "2025-02-27T20:59:12Z",
  "published": "2024-07-01T15:32:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6376"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mongodb-js/compass/commit/b1f8050d49d66be3bc499cb317a1e1de45390e51"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mongodb-js/compass"
    },
    {
      "type": "WEB",
      "url": "https://jira.mongodb.org/browse/COMPASS-7496"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ejson shell parser in MongoDB Compass maybe bypassed"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-6376 (GCVE-0-2024-6376)

FKIE_CVE-2024-6376

CERTFR-2024-AVI-0537

Solutions

CERTFR-2024-AVI-0537

Solutions

WID-SEC-W-2024-1490

GHSA-JXR4-4PRV-MH83

Tags

Sightings

Nomenclature