Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-3372
CVE-2024-3372:
MongoDB vulnerability analysis and mitigation
Overview
A critical vulnerability (CVE-2024-3372) was discovered in MongoDB Server that affects multiple versions of the software. The vulnerability stems from improper validation of certain metadata input, which can result in incorrect BSON serialization. This issue affects MongoDB Server v7.0 versions prior to 7.0.6, MongoDB Server v6.0 versions prior to 6.0.14, and MongoDB Server v5.0 versions prior to 5.0.25 (MongoDB Jira).
Technical details
The vulnerability is classified as an Improper Input Validation (CWE-20) issue. It has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The technical nature of the vulnerability involves the server's inability to correctly serialize BSON due to improper validation of metadata input (MongoDB Jira).
Impact
When exploited, this vulnerability can cause unexpected application behavior, including the unavailability of serverStatus responses. The impact is particularly significant as it can be triggered pre-authentication, potentially affecting system availability (MongoDB Jira).
Mitigation and workarounds
Users are advised to upgrade to the patched versions: MongoDB Server 7.0.6, 6.0.14, or 5.0.25, depending on their current version. These releases contain fixes for the vulnerability (MongoDB Jira).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management