9.8Kritik
CVE-2026-93762Data deletion and attribute disclosure via field-name method injection in in-memory queries
Açıklama
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.
Zayıflık türü (CWE):
CWE-470
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| MongoDB Inc. | Mongoid | 9.1.0, 9.0.0 – ≤ 9.0.11, 8.1.0 – ≤ 8.1.12, 8.0.0 – ≤ 8.0.12, 7.6.0 – ≤ 7.6.1, 7.5.0 – ≤ 7.5.4 |
Kaynaklar ve yamalar
CPE eşleşmeleri (NVD) (6)
cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:*≥ 7.5.0 < 7.5.4cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:*≥ 7.6.0 < 7.6.2cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.0.12cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:*≥ 8.1.0 < 8.1.13cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.0.12cpe:2.3:a:mongodb:mongoid:9.1.0:*:*:*:*:*:*:*