CVE-2021-20334: Local privilege escalation in MongoDB Compass for Windows

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-20334.

Q: What is the severity of CVE-2021-20334?

The severity of CVE-2021-20334 is high with a CVSS score of 7.8.

Q: Which software versions are affected by CVE-2021-20334?

CVE-2021-20334 affects MongoDB Compass 1.x version 1.3.0 on Windows and later versions.

Q: Is Microsoft Windows vulnerable to CVE-2021-20334?

No, Microsoft Windows itself is not vulnerable to CVE-2021-20334.

Published Apr 6, 2021

Updated

A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x versions prior to 1.25.0 on Windows.

Affected Software

2 affected components

MongoDB Compass>=1.3.0<1.25.0

Microsoft Windows

Event History

Apr 6, 2021

CVE Published

via MITRE·04:45 PM

Data Sourced

via MITRE·04:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-20334.

What is the severity of CVE-2021-20334?

The severity of CVE-2021-20334 is high with a CVSS score of 7.8.

Which software versions are affected by CVE-2021-20334?

CVE-2021-20334 affects MongoDB Compass 1.x version 1.3.0 on Windows and later versions.

How can a malicious 3rd party exploit CVE-2021-20334?

A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass.

Is Microsoft Windows vulnerable to CVE-2021-20334?