Vulnerability in MongoDB

CVE-2013-4650

MongoDB 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allows remote authenticated users to obtain internal system privileges by leveraging a username of __system in an arbitrary database.

EPSS: 0.017 (74.1th percentile) — read the EPSS interpretation.

Affected products

  • Mongodb — versions 2.4.0, 2.4.1, 2.4.2
  • N/a — versions n/a

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2013-4650?
CVE-2013-4650 is a vulnerability in MongoDB, classified under CWE-264. Published 2013-07-04.
Is CVE-2013-4650 known to be exploited?
3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.