9.0Kritik
CVE-2025-23061
Açıklama
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
Zayıflık türü (CWE):
CWE-94
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| mongoosejs | Mongoose | 6.0.0 – < 6.13.6, 7.0.0 – < 7.8.4, 8.0.0 – < 8.9.5 |
Kaynaklar ve yamalar
- https://www.npmjs.com/package/mongoose?activeTab=versions Product
- https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md Release Notes
- https://github.com/Automattic/mongoose/releases/tag/8.9.5 Release Notes
- https://github.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc Patch
CPE eşleşmeleri (NVD) (3)
cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*< 6.13.6cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*≥ 7.0.0 < 7.8.4cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*≥ 8.0.0 < 8.9.5