CVE-2024-6376CWE-20

ejson shell parser in MongoDB Compass maybe bypassed

High · published July 1, 2024

CVSS v3.1
7.0
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00480 · 40.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-07-01T14:57Z
EPSS history
Timeline
  • 01 JUL 14:57Z
    ejson shell parser in MongoDB Compass maybe bypassed
    cvelistv5