Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2013-1892 — Improper Input Validation in Mongodb

CWE-20 — Improper Input ValidationCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer10 documents6 sources
Severity
6.0MEDIUMNVD
EPSS
53.5%
top 2.01%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
MongodbRedhat Enterprise MRG
Timeline
PublishedOct 1
Latest updateMay 13

Description

MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 6.8 | Impact: 6.4

Affected Packages2 packages

▶NVDmongodb/mongodb2.0.8+16

🔴Vulnerability Details

2
GHSA
GHSA-vv9j-qmgv-fcp5: MongoDB before 2↗2022-05-13
▶
CVEList
CVE-2013-1892: MongoDB before 2↗2013-10-01
▶

💥Exploits & PoCs

2
Exploit-DB
MongoDB - nativeHelper.apply Remote Code Execution (Metasploit)↗2013-04-08
▶
Exploit-DB
MongoDB 2.2.3 - nativeHelper.apply Remote Code Execution↗2013-04-08
▶

📋Vendor Advisories

1
Red Hat
MongoDB: Server Side JavaScript Includes allow Remote Code Execution↗2013-03-24
▶

💬Community

4
Bugzilla
CVE-2013-3969 MongoDB: remote code execution via javascript↗2013-07-17
▶
Bugzilla
CVE-2013-1892 MongoDB: Server Side JavaScript Includes allow Remote Code Execution [epel-all]↗2013-03-27
▶
Bugzilla
CVE-2013-1892 MongoDB: Server Side JavaScript Includes allow Remote Code Execution [fedora-all]↗2013-03-27
▶
Bugzilla
CVE-2013-1892 MongoDB: Server Side JavaScript Includes allow Remote Code Execution↗2013-03-26
▶
CVE-2013-1892 — Improper Input Validation in Mongodb | cvebase