Vendor
MongoDB
390 known vulnerabilities.
Products
390 results · Feed
-
Medium 5.9
Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may termina…
-
Medium 4.3
Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt
The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermedi…
-
High 8.8
Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt
Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a se…
-
Medium 6.5
Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt
An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an …
-
Medium 5.9
Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver
The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who c…
-
Medium 4.0
Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decim…
-
Medium 6.2
Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who c…
-
Medium 5.7
One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embed…
-
Low 3.7
Out-of-bounds read in SCRAM response parsing in MongoDB C Driver
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-s…
-
Medium 4.3
Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator
In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterpri…
-
High 8.4
Heap out-of-bounds write via signed size overflow in BSON document encoding
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-b…
-
Medium 6.5
Connection redirection via percent-encoded delimiter injection in connection string hosts
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that par…
-
Medium 5.0
Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata store…
-
Medium 5.6
PHP object injection via unsuppressible __pclass class inference in command monitoring events
Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring …
-
Medium 6.5
Heap buffer overflow via mid-scan command list growth in client topology monitoring
An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. Th…
-
High 7.1
Shell script injection via server-supplied database name in Open MongoDB shell
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to…
-
High 7.1
Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel
Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. A…
-
High 8.6
Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist
Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query arg…
-
High 8.2
NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no cre…
-
High 7.5
Denial of service via unbounded regex matching in Mongoid's in-memory query matcher
An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-suppli…
-
Critical 9.8
Data deletion and attribute disclosure via field-name method injection in in-memory queries
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of…
-
Medium 6.5
Silent plaintext persistence via unresolved callable database name in encryption schema map
A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party …
-
Medium 6.5
Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation
Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error o…
-
Critical 9.1
Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation
Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation…
-
High 8.1
Cross-principal document update, theft, and deletion via unvalidated id in nested attributes
An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that rec…
-
Medium 5.3
Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()
A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the …
-
Low 3.7
libmongoc SCRAM client nonce-validation bypass
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-m…
-
High 8.1
Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream
A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap…
-
Medium 5.5
Malformed connection string may disable field level encryption
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.
-
Medium 5.5
Logs may collect sensitive information
If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys.
-
Medium 5.5
Combining encryption settings may disable encryption
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the databa…
-
High 7.5
Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption
A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a …
-
High 8.3
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated…
-
Medium 4.7
Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver
A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the applic…
-
High 8.3
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticat…
-
High 8.3
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authentica…
-
Medium 5.9
Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver
A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operat…
-
High 8.1
GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticate…
-
High 8.3
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authentica…
-
High 8.3
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenti…