PT-2024-25457 · Mongodb+1 · Mongodb Server+2

James Bronsted + 1 · Published 2024-05-14 · Updated 2025-09-23 · CVE-2024-3372

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 7.0.6 MongoDB Server versions prior to 6.0.14 MongoDB Server versions prior to 5.0.25

Description The issue is caused by improper validation of certain metadata input, which may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause unexpected application behavior, including unavailability of serverStatus responses.

Recommendations For MongoDB Server versions prior to 7.0.6, update to version 7.0.6 or later. For MongoDB Server versions prior to 6.0.14, update to version 6.0.14 or later. For MongoDB Server versions prior to 5.0.25, update to version 5.0.25 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2024-8238

ALT-PU-2024-8258

BIT-MONGODB-2024-3372

CVE-2024-3372

Affected Products

Alt Linux

Mongodb Server

Mongodb

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-3372 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-3372 · Vendor Advisory
• https://jira.mongodb.org/browse/SERVER-85263 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/722461 · Security Note
• https://osv.dev/vulnerability/BIT-mongodb-2024-3372 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-3372 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-3372 · Security Note
• https://ubuntu.com/security/CVE-2024-3372 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3372 · Note