CVE-2024-6376: ejson shell parser in MongoDB Compass maybe bypassed
First published: Mon Jul 01 2024(Updated: )
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2
Credit: cna@mongodb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MongoDB Compass | <1.42.2 | |
| npm/@mongodb-js/connection-form | <1.20.1 | 1.20.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-6376?
CVE-2024-6376 is classified as a code injection vulnerability with a critical severity level due to the risk of executing malicious code.
How do I fix CVE-2024-6376?
To fix CVE-2024-6376, upgrade MongoDB Compass to version 1.42.2 or later.
What versions of MongoDB Compass are affected by CVE-2024-6376?
CVE-2024-6376 affects all versions of MongoDB Compass prior to version 1.42.2.
What causes CVE-2024-6376?
CVE-2024-6376 is caused by insufficient sandbox protection settings in MongoDB Compass combined with the use of the ejson shell parser.
Is CVE-2024-6376 a local or remote vulnerability?
CVE-2024-6376 is a local vulnerability, as it requires access to the MongoDB Compass application to exploit.
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- agent/remedy
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/weakness
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/last-modified-date
- agent/references
- agent/source
- agent/softwarecombine
- agent/description
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-jxr4-4prv-mh83
- alias/CVE-2024-6376
- collector/nvd-cve
- vendor/mongodb
- canonical/mongodb compass
- package-manager/npm