mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0
History

Tue, 04 Mar 2025 03:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Thu, 27 Feb 2025 16:45:00 +0000

Type Values Removed Values Added
References

Thu, 27 Feb 2025 15:45:00 +0000

Type Values Removed Values Added
Description mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0
Title MongoDB Shell may be susceptible to local privilege escalation in Windows
First Time appeared Mongodb
Mongodb mongosh
Weaknesses CWE-426
CPEs cpe:2.3:a:mongodb:mongosh:0.10.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.10.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.11.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.12.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.13.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.14.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.15.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.15.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.15.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.2.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.3.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.4.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.5.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.5.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.6.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.7.7:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.8.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:0.9.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.7:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.8:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.1.9:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.10.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.5.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.6.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.6.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.7.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.8.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.90:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:1.91:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.1.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.10:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.11:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.12:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.15:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:2.2.9:*:*:*:*:*:*:*
Vendors & Products Mongodb
Mongodb mongosh
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published: 2025-02-27T15:28:11.633Z

Updated: 2025-02-27T16:06:31.860Z

Reserved: 2025-02-27T13:02:02.998Z

Link: CVE-2025-1756

cve-icon Vulnrichment

Updated: 2025-02-27T16:05:11.299Z

cve-icon NVD

Status : Received

Published: 2025-02-27T16:15:39.287

Modified: 2025-02-27T16:15:39.287

Link: CVE-2025-1756

cve-icon Redhat

No data.