Search
Find a vulnerability
Search criteria
7 vulnerabilities found for Compass by MongoDB
CERTFR-2026-AVI-1234
Vulnerability from certfr_avis - Published: 2026-09-28 - Updated: 2026-09-28
De multiples vulnérabilités ont été découvertes dans MongoDB. Elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données, un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| MongoDB | C Driver | mongo-c-driver versions antérieures à 2.5.5 | ||
| MongoDB | Compass | Compass versions antérieures à 1.49.12 | ||
| MongoDB | MongoDB | MongoDB versions antérieures à 1.21.10 | ||
| MongoDB | C Driver | mongo-c-driver versions antérieures à 1.30.12 | ||
| MongoDB | MongoDB-extension | MongoDB-extension versions 2.2.x à 2.5.x antérieures à 2.5.3 | ||
| MongoDB | PyMongo | pymongo versions antérieures à 4.18.2 | ||
| MongoDB | MongoDB | MongoDB versions 2.2.x à 2.5.x antérieures à 2.5.3 | ||
| MongoDB | MongoDB | MongoDB versions 2.x antérieures à 2.1.10 | ||
| MongoDB | MongoDB-extension | MongoDB-extension versions 2.x antérieures à 2.1.10 | ||
| MongoDB | MongoDB-extension | MongoDB-extension versions antérieures à 1.21.10 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "mongo-c-driver versions ant\u00e9rieures \u00e0 2.5.5",
"product": {
"name": "C Driver",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "Compass versions ant\u00e9rieures \u00e0 1.49.12",
"product": {
"name": "Compass",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "MongoDB versions ant\u00e9rieures \u00e0 1.21.10",
"product": {
"name": "MongoDB",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "mongo-c-driver versions ant\u00e9rieures \u00e0 1.30.12",
"product": {
"name": "C Driver",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "MongoDB-extension versions 2.2.x \u00e0 2.5.x ant\u00e9rieures \u00e0 2.5.3",
"product": {
"name": "MongoDB-extension",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "pymongo versions ant\u00e9rieures \u00e0 4.18.2",
"product": {
"name": "PyMongo",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "MongoDB versions 2.2.x \u00e0 2.5.x ant\u00e9rieures \u00e0 2.5.3",
"product": {
"name": "MongoDB",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "MongoDB versions 2.x ant\u00e9rieures \u00e0 2.1.10",
"product": {
"name": "MongoDB",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "MongoDB-extension versions 2.x ant\u00e9rieures \u00e0 2.1.10",
"product": {
"name": "MongoDB-extension",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "MongoDB-extension versions ant\u00e9rieures \u00e0 1.21.10",
"product": {
"name": "MongoDB-extension",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-96745",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96745"
},
{
"name": "CVE-2026-96748",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96748"
},
{
"name": "CVE-2026-96747",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96747"
},
{
"name": "CVE-2026-96749",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96749"
},
{
"name": "CVE-2026-96746",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96746"
}
],
"initial_release_date": "2026-09-28T00:00:00",
"last_revision_date": "2026-09-28T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1234",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-28T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans MongoDB. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es, un contournement de la politique de s\u00e9curit\u00e9 et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans MongoDB",
"vendor_advisories": [
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB GHSA-frjf-h5jg-4v46",
"url": "https://github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4v46"
},
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB GHSA-qx36-8mw2-4r3x",
"url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3x"
},
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB GHSA-vp6j-j7w5-5xjj",
"url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj"
},
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB 3579",
"url": "https://github.com/mongodb/laravel-mongodb/pull/3579"
},
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB v1.49.12",
"url": "https://github.com/mongodb-js/compass/releases/tag/v1.49.12"
},
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB GHSA-cmvj-vxvq-rh2c",
"url": "https://github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq-rh2c"
},
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB GHSA-v4x9-3549-crwv",
"url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv"
}
]
}
CERTFR-2026-AVI-0922
Vulnerability from certfr_avis - Published: 2026-07-24 - Updated: 2026-07-24
De multiples vulnérabilités ont été découvertes dans MongoDB. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité, un déni de service et un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| MongoDB | Core Server | Core Server versions 8.0.x antérieures à 8.0.28 | ||
| MongoDB | Compass | Compass versions antérieures à 1.49.7 | ||
| MongoDB | Core Server | Core Server versions 7.0.x antérieures à 7.0.39 | ||
| MongoDB | Core Server | Core Server versions 8.2.x antérieures à 8.2.12 | ||
| MongoDB | Core Server | Core Server versions 8.3.x antérieures à 8.3.7 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Core Server versions 8.0.x ant\u00e9rieures \u00e0 8.0.28",
"product": {
"name": "Core Server",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "Compass versions ant\u00e9rieures \u00e0 1.49.7",
"product": {
"name": "Compass",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "Core Server versions 7.0.x ant\u00e9rieures \u00e0 7.0.39",
"product": {
"name": "Core Server",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "Core Server versions 8.2.x ant\u00e9rieures \u00e0 8.2.12",
"product": {
"name": "Core Server",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "Core Server versions 8.3.x ant\u00e9rieures \u00e0 8.3.7",
"product": {
"name": "Core Server",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-13066",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13066"
},
{
"name": "CVE-2026-14881",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14881"
},
{
"name": "CVE-2026-13064",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13064"
},
{
"name": "CVE-2026-13071",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13071"
},
{
"name": "CVE-2026-13074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13074"
},
{
"name": "CVE-2026-13060",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13060"
},
{
"name": "CVE-2026-13065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13065"
},
{
"name": "CVE-2026-13075",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13075"
},
{
"name": "CVE-2026-13063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13063"
},
{
"name": "CVE-2026-13077",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13077"
},
{
"name": "CVE-2026-13076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13076"
},
{
"name": "CVE-2026-13061",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13061"
},
{
"name": "CVE-2026-13058",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13058"
},
{
"name": "CVE-2026-13067",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13067"
},
{
"name": "CVE-2026-13057",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13057"
},
{
"name": "CVE-2026-13059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13059"
},
{
"name": "CVE-2026-13056",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13056"
},
{
"name": "CVE-2026-13070",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13070"
},
{
"name": "CVE-2026-13062",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13062"
},
{
"name": "CVE-2026-13072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13072"
},
{
"name": "CVE-2026-9737",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9737"
},
{
"name": "CVE-2026-13073",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13073"
},
{
"name": "CVE-2026-13078",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13078"
},
{
"name": "CVE-2026-13068",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13068"
},
{
"name": "CVE-2026-13055",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13055"
},
{
"name": "CVE-2026-13069",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13069"
}
],
"initial_release_date": "2026-07-24T00:00:00",
"last_revision_date": "2026-07-24T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0922",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-24T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans MongoDB. Elles permettent \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9, un d\u00e9ni de service et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans MongoDB",
"vendor_advisories": [
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128517",
"url": "https://jira.mongodb.org/browse/SERVER-128517"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127831",
"url": "https://jira.mongodb.org/browse/SERVER-127831"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128494",
"url": "https://jira.mongodb.org/browse/SERVER-128494"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127661",
"url": "https://jira.mongodb.org/browse/SERVER-127661"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128512",
"url": "https://jira.mongodb.org/browse/SERVER-128512"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128362",
"url": "https://jira.mongodb.org/browse/SERVER-128362"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128832",
"url": "https://jira.mongodb.org/browse/SERVER-128832"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-125872",
"url": "https://jira.mongodb.org/browse/SERVER-125872"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB v1.49.7",
"url": "https://github.com/mongodb-js/compass/releases/tag/v1.49.7"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128316",
"url": "https://jira.mongodb.org/browse/SERVER-128316"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128341",
"url": "https://jira.mongodb.org/browse/SERVER-128341"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-124355",
"url": "https://jira.mongodb.org/browse/SERVER-124355"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128473",
"url": "https://jira.mongodb.org/browse/SERVER-128473"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127280",
"url": "https://jira.mongodb.org/browse/SERVER-127280"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127737",
"url": "https://jira.mongodb.org/browse/SERVER-127737"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128584",
"url": "https://jira.mongodb.org/browse/SERVER-128584"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128433",
"url": "https://jira.mongodb.org/browse/SERVER-128433"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127689",
"url": "https://jira.mongodb.org/browse/SERVER-127689"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128387",
"url": "https://jira.mongodb.org/browse/SERVER-128387"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127566",
"url": "https://jira.mongodb.org/browse/SERVER-127566"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-123081",
"url": "https://jira.mongodb.org/browse/SERVER-123081"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-126247",
"url": "https://jira.mongodb.org/browse/SERVER-126247"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-128198",
"url": "https://jira.mongodb.org/browse/SERVER-128198"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127357",
"url": "https://jira.mongodb.org/browse/SERVER-127357"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-127694",
"url": "https://jira.mongodb.org/browse/SERVER-127694"
},
{
"published_at": "2026-07-22",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-129103",
"url": "https://jira.mongodb.org/browse/SERVER-129103"
}
]
}
CERTFR-2025-AVI-0166
Vulnerability from certfr_avis - Published: 2025-02-28 - Updated: 2025-02-28
De multiples vulnérabilités ont été découvertes dans MongoDB. Elles permettent à un attaquant de provoquer une élévation de privilèges et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "mongosh versions ant\u00e9rieures \u00e0 2.3.9",
"product": {
"name": "Mongosh",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "Compass version ant\u00e9rieures \u00e0 1.42.1",
"product": {
"name": "Compass",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-1692",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1692"
},
{
"name": "CVE-2025-1691",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1691"
},
{
"name": "CVE-2025-1756",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1756"
},
{
"name": "CVE-2025-1755",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1755"
},
{
"name": "CVE-2025-1693",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1693"
}
],
"initial_release_date": "2025-02-28T00:00:00",
"last_revision_date": "2025-02-28T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0166",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-02-28T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans MongoDB. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans MongoDB",
"vendor_advisories": [
{
"published_at": "2025-02-27",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOSH-2026",
"url": "https://jira.mongodb.org/browse/MONGOSH-2026"
},
{
"published_at": "2025-02-27",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOSH-2028",
"url": "https://jira.mongodb.org/browse/MONGOSH-2028"
},
{
"published_at": "2025-02-27",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOSH-2025",
"url": "https://jira.mongodb.org/browse/MONGOSH-2025"
},
{
"published_at": "2025-02-27",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB COMPASS-9058",
"url": "https://jira.mongodb.org/browse/COMPASS-9058"
},
{
"published_at": "2025-02-27",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOSH-2024",
"url": "https://jira.mongodb.org/browse/MONGOSH-2024"
}
]
}
CERTFR-2024-AVI-0537
Vulnerability from certfr_avis - Published: 2024-07-03 - Updated: 2024-07-03
De multiples vulnérabilités ont été découvertes dans MongoDB. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| MongoDB | Server | MongoDB Server versions 5.x antérieures à 5.0.22 | ||
| MongoDB | Compass | MongoDB Compass versions antérieures à 1.42.2 | ||
| MongoDB | Server | MongoDB Server versions 7.x antérieures à 7.0.3 | ||
| MongoDB | N/A | libbson versions antérieures à 1.26.2 | ||
| MongoDB | Server | MongoDB Server versions 6.x antérieures à 6.0.11 | ||
| MongoDB | Rust Driver | MongoDB Rust Driver versions 2.x antérieures à 2.8.2 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "MongoDB Server versions 5.x ant\u00e9rieures \u00e0 5.0.22",
"product": {
"name": "Server",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "MongoDB Compass versions ant\u00e9rieures \u00e0 1.42.2",
"product": {
"name": "Compass",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "MongoDB Server versions 7.x ant\u00e9rieures \u00e0 7.0.3",
"product": {
"name": "Server",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "libbson versions ant\u00e9rieures \u00e0 1.26.2",
"product": {
"name": "N/A",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "MongoDB Server versions 6.x ant\u00e9rieures \u00e0 6.0.11",
"product": {
"name": "Server",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "MongoDB Rust Driver versions 2.x ant\u00e9rieures \u00e0 2.8.2",
"product": {
"name": "Rust Driver",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-6382",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6382"
},
{
"name": "CVE-2024-6376",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6376"
},
{
"name": "CVE-2024-6375",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6375"
},
{
"name": "CVE-2024-6381",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6381"
}
],
"initial_release_date": "2024-07-03T00:00:00",
"last_revision_date": "2024-07-03T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0537",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-07-03T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans MongoDB. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans MongoDB",
"vendor_advisories": [
{
"published_at": "2024-07-01",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB COMPASS-7496",
"url": "https://jira.mongodb.org/browse/COMPASS-7496"
},
{
"published_at": "2024-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-5622",
"url": "https://jira.mongodb.org/browse/CDRIVER-5622"
},
{
"published_at": "2024-07-01",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-79327",
"url": "https://jira.mongodb.org/browse/SERVER-79327"
},
{
"published_at": "2024-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB RUST-1881",
"url": "https://jira.mongodb.org/browse/RUST-1881"
}
]
}
CERTFR-2024-AVI-0348
Vulnerability from certfr_avis - Published: 2024-04-25 - Updated: 2024-04-25
Une vulnérabilité a été découverte dans les produits MongoDB. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "MongoDB Compass versions 1.35.0 \u00e0 1.40.5 ant\u00e9rieures \u00e0 1.42.1",
"product": {
"name": "Compass",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-3371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3371"
}
],
"initial_release_date": "2024-04-25T00:00:00",
"last_revision_date": "2024-04-25T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0348",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-04-25T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans \u003cspan class=\"textit\"\u003eles\nproduits MongoDB\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9\ndes donn\u00e9es.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans les produits MongoDB",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB COMPASS-7260 du 24 avril 2024",
"url": "https://jira.mongodb.org/browse/COMPASS-7260"
}
]
}
CERTFR-2021-AVI-243
Vulnerability from certfr_avis - Published: 2021-04-07 - Updated: 2021-04-07
Une vulnérabilité a été découverte dans MongoDB Compass. Elle permet à un attaquant de provoquer une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "MongoDB Compass versions ant\u00e9rieures \u00e0 1.25.0",
"product": {
"name": "Compass",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-20334",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20334"
}
],
"initial_release_date": "2021-04-07T00:00:00",
"last_revision_date": "2021-04-07T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB\u00a0Compass du 06 avril 2021",
"url": "https://jira.mongodb.org/browse/COMPASS-4510"
}
],
"reference": "CERTFR-2021-AVI-243",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-04-07T00:00:00.000000"
}
],
"risks": [
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans MongoDB Compass. Elle permet \u00e0\nun attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans MongoDB Compass",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB Compass du 06 avril 2021",
"url": null
}
]
}
CVE-2026-96750 (GCVE-0-2026-96750)
Vulnerability from cvelistv5 – Published: 2026-09-24 15:51 – Updated: 2026-09-25 03:55
VLAI
EPSS
VEX
Title
Shell script injection via server-supplied database name in Open MongoDB shell
Summary
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 00:00 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96750",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T03:55:27.003Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Compass",
"vendor": "MongoDB",
"versions": [
{
"lessThan": "1.49.12",
"status": "affected",
"version": "1.44.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database\u0027s view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process\u0027s privileges. This requires the Compass user to open the shell for the affected database."
}
],
"value": "MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database\u0027s view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process\u0027s privileges. This requires the Compass user to open the shell for the affected database."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T15:51:13.247Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://github.com/mongodb-js/compass/releases/tag/v1.49.12"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Shell script injection via server-supplied database name in Open MongoDB shell",
"x_generator": {
"engine": "cve_record_builder.py"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2026-96750",
"datePublished": "2026-09-24T15:51:13.247Z",
"dateReserved": "2026-09-23T15:45:51.994Z",
"dateUpdated": "2026-09-25T03:55:27.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}