by Kastro
Paper/Archive/CVE-2024-6376

CVE-2024-6376

MongoDB Inc MongoDB Compass — ejson shell parser in MongoDB Compass maybe bypassed

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 41.5.415 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2

Affected

ProductAffectedFixed inSource
MongoDB Compass< 1.42.21.42.2CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mongodb (CNA)7.0CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refjira.mongodb.org/browse/COMPASS-7496