PT-2013-4765 · Mongodb · Mongodb

Published 2013-10-01 · Updated 2013-10-02 · CVE-2013-3969

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MongoDB versions 2.4.0 through 2.4.4

Description The issue allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via an invalid RefDB object, resulting from an uninitialized pointer dereference and server crash in the find prototype in scripting/engine v8.h.

Recommendations For MongoDB versions 2.4.0 through 2.4.4, update to a version outside of this range to resolve the issue.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2013-3969

Affected Products

Mongodb

References · 8

• 🔥 https://exploit-db.com/exploits/38669 · Exploit
• http://mongodb.org/about/alerts · Vendor Advisory
• http://secunia.com/advisories/54170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3969 · Security Note
• http://openwall.com/lists/oss-security/2013/07/30/10 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3969 · Note
• http://blog.scrt.ch/2013/06/04/mongodb-rce-by-databasespraying · Note
• https://jira.mongodb.org/browse/SERVER-9878 · Note