CVE-2024-10921CWE-158

Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server

Medium · published November 14, 2024

CVSS v3.1
6.8
EPSS
1%
Percentile
45.4
In the wild
Unconfirmed
What it is

An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00553 · 45.4th percentile
Weakness
CWE-158 · Improper Neutralization of Null Byte or NUL Character
Published
2024-11-14T16:04Z
EPSS history
Timeline
  • 14 NOV 16:04Z
    Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server
    cvelistv5