CVE-2024-3371: Insufficient validation of external input in Compass may enable MITM attacks
MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3371?
CVE-2024-3371 is classified as a high severity vulnerability due to the potential for data disclosure and user impersonation.
How do I fix CVE-2024-3371?
To fix CVE-2024-3371, upgrade MongoDB Compass to version 1.42.1 or later, where the vulnerability has been addressed.
Which versions of MongoDB Compass are affected by CVE-2024-3371?
CVE-2024-3371 affects MongoDB Compass versions 1.35.0 through 1.42.0.
What types of attacks are possible due to CVE-2024-3371?
CVE-2024-3371 may allow attackers to impersonate users and access sensitive data due to insufficient input validation.
Can I mitigate CVE-2024-3371 without upgrading?
While upgrading is the recommended solution, reviewing input validation processes may help mitigate some risk associated with CVE-2024-3371.