CVE-2024-3374 MEDIUM

CVE-2024-3374: MongoDB Server (mongod) may crash when generating ftdc

Vendor Mongodb Inc
Product MongoDB Server
Weakness CWE-617
Published May 14, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.16 and MongoDB Server v6.0 versions prior to and including 6.0.5.

Key dates

02Disclosure timeline

May 14, 2024 CVE published
August 1, 2024 Record updated