An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build configurations, this assertion failure results in termination of the mongod process, causing a denial of service to all connected clients.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| mongodb | mongodb | 7.0.0 – < 7.0.41 | |
| MongoDB | MongoDB Server | 8.3.0 – < 8.3.9, 8.0.0 – < 8.0.30, 7.0.0 – < 7.0.41 |
cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:* ≥ 7.0.0 < 7.0.41cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:* ≥ 8.0.0 < 8.0.30cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:* ≥ 8.3.0 < 8.3.9Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.