CVE-2021-20334CWE-269

Local privilege escalation in MongoDB Compass for Windows

Medium · published April 6, 2021

CVSS v3.1
4.8
EPSS
0%
Percentile
9.7
In the wild
Unconfirmed
What it is

A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x versions prior to 1.25.0 on Windows.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00202 · 9.7th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2021-04-06T16:45Z
EPSS history
Timeline
  • 06 APR 16:45Z
    Local privilege escalation in MongoDB Compass for Windows
    cvelistv5