CVE-2024-10921 (GCVE-0-2024-10921)
Vulnerability from cvelistv5
Published
2024-11-14 16:04
Modified
2024-11-15 09:45
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-158 - Improper Neutralization of Null Byte or NUL Character
Summary
An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.
References
| URL | Tags | ||||||
|---|---|---|---|---|---|---|---|
|
|||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MongoDB Inc | MongoDB Server |
Version: 5.0 < 5.0.30 Version: 6.0 < 6.0.19 Version: 7.0 < 7.0.15 Version: 8.0 < 8.0.3 cpe:2.3:a:mongodb:mongodb:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.5:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.6:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.7:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.8:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.9:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.10:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.11:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.12:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.13:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.14:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.15:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.16:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.17:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.18:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.19:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.20:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.21:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.22:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.23:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.24:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.25:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.26:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.27:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.28:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:5.0.29:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.5:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.6:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.7:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.8:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.9:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.10:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.11:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.12:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.13:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.14:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.15:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.16:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.17:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:6.0.18:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.5:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.6:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.7:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.8:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.9:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.10:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.11:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.12:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.13:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:7.0.14:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:8.0.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:8.0.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongodb:8.0.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10921",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T17:00:58.644599Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-14T17:02:00.691Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mongodb:mongodb:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.8:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.9:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.10:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.11:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.12:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.13:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.14:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.15:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.16:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.17:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.18:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.19:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.20:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.21:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.22:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.23:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.24:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.25:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.26:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.27:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.28:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:5.0.29:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.8:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.9:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.10:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.11:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.12:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.13:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.14:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.15:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.16:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.17:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:6.0.18:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.8:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.9:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.10:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.11:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.12:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.13:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:7.0.14:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:8.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:8.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongodb:8.0.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "MongoDB Server",
"vendor": "MongoDB Inc",
"versions": [
{
"lessThan": "5.0.30",
"status": "affected",
"version": "5.0",
"versionType": "custom"
},
{
"lessThan": "6.0.19",
"status": "affected",
"version": "6.0",
"versionType": "custom"
},
{
"lessThan": "7.0.15",
"status": "affected",
"version": "7.0",
"versionType": "custom"
},
{
"lessThan": "8.0.3",
"status": "affected",
"version": "8.0",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-11-14T16:02:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eAn authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.\u003c/span\u003e \u003cbr\u003e"
}
],
"value": "An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-158",
"description": "CWE-158: Improper Neutralization of Null Byte or NUL Character",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T09:45:56.720Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-96419"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Customers and users should promptly upgrade to a patched version of the MongoDB Server product. At the time of publication, no misuse of this issue has been observed.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Customers and users should promptly upgrade to a patched version of the MongoDB Server product. At the time of publication, no misuse of this issue has been observed."
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2024-10921",
"datePublished": "2024-11-14T16:04:04.062Z",
"dateReserved": "2024-11-06T13:26:36.873Z",
"dateUpdated": "2024-11-15T09:45:56.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-10921\",\"sourceIdentifier\":\"cna@mongodb.com\",\"published\":\"2024-11-14T16:15:18.030\",\"lastModified\":\"2025-10-01T18:40:03.557\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.\"},{\"lang\":\"es\",\"value\":\"Un usuario autorizado puede provocar fallas o recibir el contenido de lecturas excesivas del b\u00fafer de la memoria del servidor al emitir solicitudes especialmente manipuladas que construyen un BSON mal formado en MongoDB Server. Este problema afecta a las versiones de MongoDB Server v5.0 anteriores a la 5.0.30, a las versiones de MongoDB Server v6.0 anteriores a la 6.0.19, a las versiones de MongoDB Server v7.0 anteriores a la 7.0.15 y a las versiones de MongoDB Server v8.0 anteriores a la 8.0.2 incluida.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@mongodb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"cna@mongodb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-158\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0.0\",\"versionEndExcluding\":\"5.0.30\",\"matchCriteriaId\":\"F0507ED4-0FB8-4620-A69F-46C9B944F17A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.0.19\",\"matchCriteriaId\":\"C3660893-5F80-475A-BE2E-322F2575C6A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndExcluding\":\"7.0.15\",\"matchCriteriaId\":\"4D72503B-E4B3-487B-9A65-8EFC23F19D58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.0.3\",\"matchCriteriaId\":\"4D93A23B-DA66-479F-AEF7-BA5027ADA81C\"}]}]}],\"references\":[{\"url\":\"https://jira.mongodb.org/browse/SERVER-96419\",\"source\":\"cna@mongodb.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-10921\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-14T17:00:58.644599Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-14T17:01:56.646Z\"}}], \"cna\": {\"title\": \"Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server\", \"source\": {\"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:mongodb:mongodb:5.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.8:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.9:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.10:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.11:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.12:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.13:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.14:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.15:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.16:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.17:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.18:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.19:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.20:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.21:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.22:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.23:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.24:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.25:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.26:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.27:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.28:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.29:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.8:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.9:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.10:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.11:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.12:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.13:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.14:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.15:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.16:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.17:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.18:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.8:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.9:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.10:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.11:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.12:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.13:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.14:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:8.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:8.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:8.0.2:*:*:*:*:*:*:*\"], \"vendor\": \"MongoDB Inc\", \"product\": \"MongoDB Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.0\", \"lessThan\": \"5.0.30\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.0\", \"lessThan\": \"6.0.19\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.0\", \"lessThan\": \"7.0.15\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"8.0\", \"lessThan\": \"8.0.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Customers and users should promptly upgrade to a patched version of the MongoDB Server product. At the time of publication, no misuse of this issue has been observed.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Customers and users should promptly upgrade to a patched version of the MongoDB Server product. At the time of publication, no misuse of this issue has been observed.\u003cbr\u003e\u003cbr\u003e\", \"base64\": false}]}], \"datePublic\": \"2024-11-14T16:02:00.000Z\", \"references\": [{\"url\": \"https://jira.mongodb.org/browse/SERVER-96419\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: transparent;\\\"\u003eAn authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.\u003c/span\u003e \u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-158\", \"description\": \"CWE-158: Improper Neutralization of Null Byte or NUL Character\"}]}], \"providerMetadata\": {\"orgId\": \"a39b4221-9bd0-4244-95fc-f3e2e07f1deb\", \"shortName\": \"mongodb\", \"dateUpdated\": \"2024-11-15T09:45:56.720Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-10921\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-15T09:45:56.720Z\", \"dateReserved\": \"2024-11-06T13:26:36.873Z\", \"assignerOrgId\": \"a39b4221-9bd0-4244-95fc-f3e2e07f1deb\", \"datePublished\": \"2024-11-14T16:04:04.062Z\", \"assignerShortName\": \"mongodb\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…