Description (CNA)
A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| MongoDB / MongoDB | affected 8.3.0 through 8.3.3; affected 8.2.0 through 8.2.10; affected 8.0.0 through 8.0.25; affected 7.0.0 through 7.0.36; affected 6.0 through 6.0.28; affected 5.0 through 5.0.33; affected 4.4.0 through 4.4.30 |
CWE
CWE-787
References
ADP enrichment
No English description supplied.
No references supplied.