Vulnerability in MongoDB Mongocryptd
CVE-2024-8013
A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 2.2 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.001 (1.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 2nd percentile — 1.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: 0.000
Affected products
- MongoDB Mongocryptd
- MongoDB Mongo Crypt V1.so
- MongoDB Inc Mongocryptd — versions 5.0, 6.0, 7.0
- MongoDB Inc Mongo Crypt V1.so — versions 6.0, 7.0, 7.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- jira.mongodb.org/browse/SERVER-96254 (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-8013?
- CVE-2024-8013 is a low-severity vulnerability in MongoDB Mongocryptd, classified under Cleartext Transmission of Sensitive Information. CVSS score: 2.2/10. Published 2024-10-28.
- How severe is CVE-2024-8013?
- Low severity. CVSS v3 base score is 2.2 out of 10.
- Is CVE-2024-8013 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.