FKIE_CVE-2025-3083

Vulnerability from fkie_nvd - Published: 2025-04-01 12:15 - Updated: 2025-09-22 14:15
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31,  MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to 7.0.16
References
cna@mongodb.comhttps://jira.mongodb.org/browse/SERVER-103152Issue Tracking, Vendor Advisory
Impacted products
Vendor Product Version
mongodb mongodb *
mongodb mongodb *
mongodb mongodb *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "66128ED7-B1B4-44B8-9295-D27461F161EA",
              "versionEndExcluding": "5.0.31",
              "versionStartIncluding": "5.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F398EABB-311B-4726-A414-537D4EEE1A26",
              "versionEndExcluding": "6.0.20",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E95B2F98-7920-4A34-8E4F-F01DB87A76FA",
              "versionEndExcluding": "7.0.16",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, \u00a0MongoDB v6.0 versions prior to\u00a06.0.20 and MongoDB v7.0 versions prior to 7.0.16"
    },
    {
      "lang": "es",
      "value": "Los mensajes de protocolo de conexi\u00f3n MongoDB manipulados espec\u00edficamente pueden provocar el bloqueo de MongoDB durante la validaci\u00f3n de comandos. Esto puede ocurrir sin usar una conexi\u00f3n autenticada. Este problema afecta a MongoDB v5.0 anteriores a la 5.0.31, MongoDB v6.0 anteriores a la 6.0.20 y MongoDB v7.0 anteriores a la 7.0.16."
    }
  ],
  "id": "CVE-2025-3083",
  "lastModified": "2025-09-22T14:15:59.510",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "cna@mongodb.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-04-01T12:15:15.883",
  "references": [
    {
      "source": "cna@mongodb.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://jira.mongodb.org/browse/SERVER-103152"
    }
  ],
  "sourceIdentifier": "cna@mongodb.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        }
      ],
      "source": "cna@mongodb.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.