CveMateVulnerability intelligence

Mongodb Inc. vulnerabilities

139 vulnerabilities

Known vulnerabilities in Mongodb Inc. products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 36 products.

Products

36

Mongodb Server82 vulnerabilities
Mongoid8 vulnerabilities
Mongodb C Driver6 vulnerabilities
C Driver5 vulnerabilities
Mongodb Ops Manager5 vulnerabilities
Mongodb Compass4 vulnerabilities
Mongosh4 vulnerabilities
Libbson3 vulnerabilities
Mongodb Entity Framework Core Provider3 vulnerabilities
Mongodb Go Driver2 vulnerabilities
Mongodb PHP Driver2 vulnerabilities
Mongodb Rust Driver2 vulnerabilities
Compass1 vulnerabilities
Js Bson1 vulnerabilities
Mongo Crypt V1.So1 vulnerabilities
Mongo Java Driver1 vulnerabilities
Mongocryptd1 vulnerabilities
Mongodb Atlas Kubernetes Operator1 vulnerabilities
Mongodb Connector For BI1 vulnerabilities
Mongodb Controllers For Kubernetes1 vulnerabilities
Mongodb Database Tools1 vulnerabilities
Mongodb Enterprise Kubernetes Operator1 vulnerabilities
Mongodb For VS Code1 vulnerabilities
Mongodb .Net/C# Driver1 vulnerabilities
Mongodb Node.Js Driver1 vulnerabilities
Mongodb Node.Js Driver Mongodb Client Encryption Module1 vulnerabilities
Mongodb Ruby Driver1 vulnerabilities
Mongodb Swift Driver1 vulnerabilities
Mongodb Driver1 vulnerabilities
Mongodb Driver Legacy1 vulnerabilities
Mongodb Driver Sync1 vulnerabilities
Mongomirror1 vulnerabilities
Ops Manager1 vulnerabilities
PHP Driver1 vulnerabilities
Pymongo1 vulnerabilities
Server1 vulnerabilities

CVE-2018-20805ubuntumongodb+25y ago23-11-2020 15:20

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10.CVE-2018-20802ubuntumongodb+25y ago23-11-2020 15:15

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3.CVE-2018-20804ubuntumongodb+25y ago23-11-2020 15:15

A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Server v4.0 versions prior to 4.0.10 and MongoDB Server v3.6 versions prior to 3.6.13.CVE-2018-20803ubuntumongodb+25y ago23-11-2020 17:30

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining locks. This issue affects MongoDB Server v4.0 versions prior to 4.0.5; MongoDB Server v3.6 versions prior to 3.6.10 and MongoDB Server v3.4 versions prior to 3.4.19.CVE-2018-25004ubuntumongodb+25y ago01-03-2021 16:15

A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11.CVE-2021-20328ubuntumongo-java-driver+105y ago25-02-2021 16:30

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.CVE-2021-20331mongodb incmongodb c driver+25y ago13-05-2021 07:40

Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1.CVE-2021-20334mongodb incmongodb compass+15y ago06-04-2021 16:45

A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x versions prior to 1.25.0 on Windows.CVE-2021-20333ubuntumongodb+25y ago23-07-2021 11:25

Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21 and MongoDB Server v4.2 versions prior to 4.2.10.CVE-2021-20335ubuntumongodb+25y ago11-02-2021 10:10

For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB Ops Manager instances have finished upgrading to MongoDB Ops Manager 4.4. In addition, customers must be running with clientCertificateMode=OPTIONAL / allowConnectionsWithoutCertificates=true to be impacted*.* Customers upgrading from Ops Manager 4.2.X to 4.2.24 and finally to Ops Manager 4.4.13+ are unaffected by this issue.CVE-2021-20332Crates.Iomongodb+25y ago02-08-2021 12:50

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credentials. Note that such monitoring is not enabled by default. This issue affects MongoDB Rust Driver version 2.0.0-alpha, MongoDB Rust Driver version 2.0.0-alpha1 and MongoDB Rust Driver version 1.0.0 through to and including 1.2.1 CVE-2021-20329ubuntumongodb+35y ago10-06-2021 16:30

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.CVE-2021-20330ubuntumongodb+24y ago15-12-2021 12:30

An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9.CVE-2021-20327mongodb inc.mongodb node.js driver mongodb-client-encryption module+25y ago25-02-2021 16:25

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption. This issue affect MongoDB Node.js Driver mongodb-client-encryption module version 1.2.0 CVE-2021-20326ubuntumongodb+25y ago30-04-2021 09:10

A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4.CVE-2021-32039mongodb inc.mongodb for vs code+14y ago20-01-2022 14:50

Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension for VS Code including and prior to version 0.7.0 CVE-2021-32036ubuntumongodb+24y ago04-02-2022 22:33

An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28 CVE-2021-32050mongodbmongodb+173y ago29-08-2023 15:24

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).CVE-2021-32037ubuntumongodb+24y ago24-11-2021 10:40

An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually, the requests are sent via mongos and special privileges are required in order to know the address of the shards and to log in to the shards of an auth enabled environment. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.2.CVE-2021-32040ubuntumongodb+24y ago12-04-2022 14:15

It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prior to 5.0.4 and MongoDB Server v4.2 versions prior to 4.2.16. Workaround: >= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash.