9.8

CVE-2026-3431

EPSS 0.07%
Veröffentlicht 02.03.2026 13:16:05
Zuletzt bearbeitet 06.03.2026 20:30:24
Quelle vulnreport@tenable.com
CVE-Watchlists
Login
Unerledigt
Login

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Sim ≫ Sim Version < 0.5.74

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.07%	0.222

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
vulnreport@tenable.com	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://www.tenable.com/security/research/tra-2026-12

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2026-3431

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-3431

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-3431

EUVD