by Kastro
Paper/Archive/CVE-2024-8654

CVE-2024-8654

MongoDB Inc MongoDB Server — MongoDB Server may access non-initialized region of memory leading to unexpected behaviour

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 31.2.312 × 206.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3.

Affected

ProductAffectedFixed inSource
MongoDB Server6.0.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mongodb (CNA)5.0CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refjira.mongodb.org/browse/SERVER-71477refsecurity.netapp.com/advisory/ntap-20250516-0008