CVE-2025-12100: MongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directories
Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector ODBC driver: from 1.0.0 through 1.4.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MongoDB BI Connector ODBC driverto a version that resolves this vulnerability.Fixed in 1.4.6 - Compensating control
For MongoDB BI Connector ODBC driver MSI installations on custom directories, verify ACLs are set correctly after installation (the MSI installer may leave ACLs unset on custom installation directories), and set appropriate ACLs on the custom installation path.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12100?
CVE-2025-12100 is considered a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2025-12100?
To mitigate CVE-2025-12100, upgrade the MongoDB BI Connector ODBC driver to version 1.4.7 or later.
What versions of MongoDB BI Connector ODBC driver are affected by CVE-2025-12100?
CVE-2025-12100 affects MongoDB BI Connector ODBC driver versions from 1.0.0 through 1.4.6.
What type of vulnerability is CVE-2025-12100?
CVE-2025-12100 is classified as an Incorrect Default Permissions vulnerability.
Can CVE-2025-12100 lead to unauthorized access?
Yes, CVE-2025-12100 can allow unauthorized users to escalate their privileges within the system.