DeutschShown in its original language — a full translation is planned for a future version.
MongoDB und MongoDB Compass: Mehrere Schwachstellen
view advisory published 2025-02-27
Ein entfernter authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in MongoDB und MongoDB Compass ausnutzen, um beliebigen Code auszuführen, Daten zu manipulieren und erhöhte Rechte zu erlangen.
01
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-1756US | high7.8 | — | ||
mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a craft… | ||||
| CVE-2025-1755US | high7.8 | — | ||
MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, whe… | ||||
| CVE-2025-1693US | medium6.8 | — | ||
The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell o… | ||||
| CVE-2025-1692US | high8.8 | — | ||
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that eva… | ||||
| CVE-2025-1691US | medium6.5 | — | ||
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input… | ||||
02
references
External citations — patches, advisories, analysis.
- MongoDB JIRA Ticket COMPASS-9058 vom 2025-02-27external
- MongoDB JIRA Ticket MONGOSH-2024 vom 2025-02-27external
- MongoDB JIRA Ticket MONGOSH-2025 vom 2025-02-27external
- MongoDB JIRA Ticket MONGOSH-2026 vom 2025-02-27external
- MongoDB JIRA Ticket MONGOSH-2028 vom 2025-02-27external
- WID-SEC-W-2025-0454 - CSAF Versionself
- WID-SEC-2025-0454 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan