Paper/Archive/CVE-2025-3085

CVE-2025-3085

MongoDB Inc MongoDB Server — MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked

EPSS 0.3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 21.3.213 × 204.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-cluster authentication. This issue affects MongoDB Server v5.0 versions prior to 5.0.31, MongoDB Server v6.0 versions prior to 6.0.20, MongoDB Server v7.0 versions prior to 7.0.16 and MongoDB Server v8.0 versions prior to 8.0.4. Required Configuration : MongoDB Server must be running on Linux Operating Systems and CRL revocation status checking must be enabled

Affected

ProductAffectedFixed inSource

MongoDB Server5.0 – < 5.0.315.0.31CNA

MongoDB Server6.0 – < 6.0.206.0.20CNA

MongoDB Server7.0 – < 7.0.167.0.16CNA

MongoDB Server8.0. – < 8.0.48.0.4CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

mongodb (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refjira.mongodb.org/browse/SERVER-95445