CVE-2025-3083

Published Apr 1, 2025

Last updated 3 days ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-3083 affects MongoDB. Specifically crafted MongoDB wire protocol messages can cause `mongos` to crash during command validation. This can occur even without an authenticated connection. The vulnerability impacts MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20, and MongoDB v7.0 versions prior to 7.0.16. To remediate this vulnerability, it is advised to upgrade to MongoDB version 5.0.31, 6.0.20, or version 7.0.16 or later.

Description: Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to 7.0.16
Source: cna@mongodb.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

cna@mongodb.com: CWE-248

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References