CVE-2024-3374

EPSS 0.61%
Published 14.05.2024 16:17:31
Last modified 29.09.2025 18:05:41
Source cna@mongodb.com
Teams watchlist Login
Open Login

An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.16 and MongoDB Server v6.0 versions prior to and including 6.0.5.

Affected products Warnungen 0 Metrics 2 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Mongodb ≫ Mongodb Version >= 5.0.0 <= 5.0.16

Mongodb ≫ Mongodb Version >= 6.0.0 <= 6.0.5

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.61%	0.689

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
cna@mongodb.com	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-617 Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

https://jira.mongodb.org/browse/SERVER-75601

Vendor Advisory

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2024-3374

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-3374

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-3374

EUVD