CVE-2024-3371
Insufficient validation of external input in Compass may enable MITM attacks
- State
- Published
- Severity
- 7.1 High
- Published
- Apr 24, 2024
- Updated
- Aug 7, 2024
- Reserved
- Apr 5, 2024
Description
MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L | mongodb |
Weaknesses
- CWE-360 Trust of System Event Data
Affected Products
| Product | Versions |
|---|---|
MongoDB CompassMongoDB Inc |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.