CVE-2024-3371: Insufficient validation of external input in Compass may enable MITM attacks
First published: Wed Apr 24 2024(Updated: )
MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.
Credit: cna@mongodb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MongoDB Compass | >=1.35.0<=1.42.0 | |
| MongoDB Compass | >=1.35.0<1.42.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-3371?
CVE-2024-3371 is classified as a high severity vulnerability due to the potential for data disclosure and user impersonation.
How do I fix CVE-2024-3371?
To fix CVE-2024-3371, upgrade MongoDB Compass to version 1.42.1 or later, where the vulnerability has been addressed.
Which versions of MongoDB Compass are affected by CVE-2024-3371?
CVE-2024-3371 affects MongoDB Compass versions 1.35.0 through 1.42.0.
What types of attacks are possible due to CVE-2024-3371?
CVE-2024-3371 may allow attackers to impersonate users and access sensitive data due to insufficient input validation.
Can I mitigate CVE-2024-3371 without upgrading?
While upgrading is the recommended solution, reviewing input validation processes may help mitigate some risk associated with CVE-2024-3371.
- agent/title
- agent/references
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/author
- agent/description
- agent/epss
- collector/epss-latest
- source/FIRST
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/last-modified-date
- agent/severity
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- vendor/mongodb
- canonical/mongodb compass
- version/mongodb compass/1.35.0