CVE-2024-3371: compass — Fix

Description

MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.

Is your site exposed to CVE-2024-3371?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.1

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness Type (CWE)

CWE-360 CWE-360

Affected Products

Vendor	Product	Versions
mongodb	compass	1.35.0 — 1.42.1

References

Advisories & Patches

https://jira.mongodb.org/browse/COMPASS-7260 https://jira.mongodb.org/browse/COMPASS-7260

Frequently Asked Questions

What is CVE-2024-3371? +

MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0. It has a CVSS v3.1 base score of 7.1 (HIGH).

How severe is CVE-2024-3371? +

CVE-2024-3371 has a CVSS v3.1 score of 7.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-3371? +

CVE-2024-3371 affects products from mongodb, specifically: compass. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-3371? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-1351 8.8

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections …

CVE-2026-8053 8.8

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds …

CVE-2025-0755 8.4

The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that …

CVE-2025-3085 8.1

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check …

CVE-2025-11695 8.0

When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to …

CVE-2025-6713 7.7

An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling …

CVE-2024-3371