PT-2025-41315 · Mongodb · Mongodb Connector For Bi

Published 2025-10-08 · Updated 2025-10-08 · CVE-2025-11535

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions MongoDB Connector for BI versions 2.0.0 through 2.14.24

Description The installation of MongoDB Connector for BI via MSI on Windows may result in Privilege Escalation due to improperly configured Access Control Lists (ACLs) on custom installation directories. This allows for potential unauthorized access and control over the system.

Recommendations Update MongoDB Connector for BI to a version later than 2.14.24.

Fix

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-11535

Affected Products

Mongodb Connector For Bi

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-11535 · Security Note
• https://twitter.com/CveFindCom/status/1976054812790640901 · Twitter Post
• https://mongodb.com/docs/bi-connector/current/release-notes/#bi-2.14.25 · Note
• https://t.me/cveNotify/137914 · Telegram Post
• https://twitter.com/CVEnew/status/1976053371447775317 · Twitter Post