CVE-2021-20334

Local privilege escalation in MongoDB Compass for Windows

State: Published
Severity: 4.8 Medium
Published: Apr 6, 2021
Updated: Sep 17, 2024
Reserved: Dec 17, 2020

Description

A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x versions prior to 1.25.0 on Windows.

Scores

CVSS	Score	Vector	Source
3.1	4.8 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L	mongodb

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
MongoDB CompassMongoDB Inc.	1.3.0 to before 1.x*Affectedfrom 1.25.0Not affected

References

https://jira.mongodb.org/browse/COMPASS-4510

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.