CVE-2025-3082 — Improper Access Control in INC Mongodb Server

CWE-284 — Improper Access Control4 documents4 sources

Severity

5.4MEDIUMNVD

CNA3.1

EPSS

0.2%

top 60.28%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mongodb INC Mongodb Server Mongodb

Timeline

PublishedApr 1

Description

A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version prior to 7.0.14 and MongoDB Server v7.3 versions prior to 7.3.4.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶CVEListV5mongodb_inc/mongodb_server5.0 — 5.0.31+3

▶NVDmongodb/mongodb5.0.0 — 5.0.31+3

🔴Vulnerability Details

GHSA

GHSA-77w4-3h74-q5hf: A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlyin↗2025-04-01

▶

OSV

CVE-2025-3082: A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlyin↗2025-04-01

▶

CVEList

User may override a view's collation and gain unauthorized access to underlying data↗2025-04-01

▶