CVE-2024-3371

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-360

Affected software

No affected versions have been published.

Timeline

Published: Apr 24, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-33727.5Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authenticat CVE-2024-337226.3SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].CVE-2024-337245.4SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.CVE-2024-33739.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RSM Design Website Template allows SQL CVE-2024-33745.3An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BS CVE-2024-337484.1Cross-site scripting (XSS) vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier.CVE-2024-337499.1DedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php.CVE-2024-33759.4Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Co CVE-2024-337526.3An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote CVE-2024-337538.2Section Camera V2.5.5.3116-S50-SMA-B20160811 and earlier versions allow the accounts and passwords of administrators and users to be changed CVE-2024-33769.8A vulnerability classified as critical has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown p CVE-2024-337637.5lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp.