Vulnerability in Mongodb Mongocryptd
CVE-2024-8013
A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.
EPSS: 0.001 (2.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 2.2 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N.
Affected products
- Mongodb Mongocryptd
- Mongodb Mongo_crypt_v1.so
- Mongodb Inc Mongocryptd — versions 5.0, 6.0, 7.0
- Mongodb Inc Mongo_crypt_v1.so — versions 6.0, 7.0, 7.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@mongodb.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-8013?
- CVE-2024-8013 is a low-severity vulnerability in Mongodb Mongocryptd, classified under Cleartext Transmission of Sensitive Information. CVSS score: 2.2/10. Published 2024-10-28.
- How severe is CVE-2024-8013?
- Low severity. CVSS v3 base score is 2.2 out of 10.
- Is CVE-2024-8013 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.