Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-3084

Summary
Assigner-mongodb
Assigner Org ID-a39b4221-9bd0-4244-95fc-f3e2e07f1deb
Published At-01 Apr, 2025 | 11:14
Updated At-01 Apr, 2025 | 13:10
Rejected At-
Credits

MongoDB Server may crash due to improper validation of explain command

When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:mongodb
Assigner Org ID:a39b4221-9bd0-4244-95fc-f3e2e07f1deb
Published At:01 Apr, 2025 | 11:14
Updated At:01 Apr, 2025 | 13:10
Rejected At:
▼CVE Numbering Authority (CNA)
MongoDB Server may crash due to improper validation of explain command

When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4

Affected Products
Vendor
MongoDB, Inc.MongoDB Inc
Product
MongoDB Server
CPEs
  • cpe:2.3:a:mongodb:mongodb:5.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.16:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.17:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.18:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.19:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.20:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.21:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.22:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.23:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.24:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.25:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.26:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.27:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.28:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.29:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:5.0.30:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.16:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.17:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.18:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:6.0.19:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:7.0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:8.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:8.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:8.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mongodb:mongodb:8.0.3:*:*:*:*:*:*:*
Default Status
unaffected
Versions
Affected
  • From 5.0 before 5.0.31 (custom)
  • From 6.0 before 6.0.20 (custom)
  • From 7.0 before 7.0.16 (custom)
  • From 8.0 before 8.0.4 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-703CWE-703: Improper Check or Handling of Exceptional Conditions
Type: CWE
CWE ID: CWE-703
Description: CWE-703: Improper Check or Handling of Exceptional Conditions
Metrics
VersionBase scoreBase severityVector
3.16.5MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 6.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://jira.mongodb.org/browse/SERVER-103153
N/A
Hyperlink: https://jira.mongodb.org/browse/SERVER-103153
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:cna@mongodb.com
Published At:01 Apr, 2025 | 12:15
Updated At:01 Apr, 2025 | 20:26

When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.16.5MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Type: Secondary
Version: 3.1
Base score: 6.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CPE Matches

Weaknesses
CWE IDTypeSource
CWE-703Secondarycna@mongodb.com
CWE ID: CWE-703
Type: Secondary
Source: cna@mongodb.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://jira.mongodb.org/browse/SERVER-103153cna@mongodb.com
N/A
Hyperlink: https://jira.mongodb.org/browse/SERVER-103153
Source: cna@mongodb.com
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

7Records found

CVE-2025-6712
Matching Score-8
Assigner-MongoDB, Inc.
ShareView Details
Matching Score-8
Assigner-MongoDB, Inc.
CVSS Score-6.5||MEDIUM
EPSS-0.05% / 15.39%
||
7 Day CHG~0.00%
Published-07 Jul, 2025 | 14:44
Updated-08 Jul, 2025 | 16:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation

MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal operations. In scenarios where certain internal processes persist longer than anticipated, memory consumption can increase, potentially impacting server stability and availability. This issue affects MongoDB Server v8.0 versions prior to 8.0.10

Action-Not Available
Vendor-MongoDB, Inc.
Product-MongoDB Server
CWE ID-CWE-400
Uncontrolled Resource Consumption
CVE-2025-7259
Matching Score-8
Assigner-MongoDB, Inc.
ShareView Details
Matching Score-8
Assigner-MongoDB, Inc.
CVSS Score-6.5||MEDIUM
EPSS-0.05% / 15.33%
||
7 Day CHG~0.00%
Published-07 Jul, 2025 | 15:59
Updated-08 Jul, 2025 | 16:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Certain Queries with Duplicate _id Fields May Cause MongoDB Server to Crash

An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can only be triggered by authorized users and cause Denial of Service. This issue affects MongoDB Server v8.1 version 8.1.0.

Action-Not Available
Vendor-MongoDB, Inc.
Product-MongoDB Server
CWE ID-CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')
CVE-2024-8305
Matching Score-8
Assigner-MongoDB, Inc.
ShareView Details
Matching Score-8
Assigner-MongoDB, Inc.
CVSS Score-6.5||MEDIUM
EPSS-0.31% / 53.29%
||
7 Day CHG~0.00%
Published-21 Oct, 2024 | 14:10
Updated-07 Nov, 2024 | 15:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
MongoDB Server secondaries may crash due to forced index constraints

prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4

Action-Not Available
Vendor-MongoDB, Inc.
Product-mongodbMongoDB Server
CWE ID-CWE-1288
Improper Validation of Consistency within Input
CVE-2025-54134
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-7.1||HIGH
EPSS-0.08% / 24.59%
||
7 Day CHG+0.01%
Published-21 Jul, 2025 | 20:58
Updated-30 Jul, 2025 | 17:07
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service

HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9.

Action-Not Available
Vendor-psuhaxtheweb
Product-haxcms-nodejsissues
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-248
Uncaught Exception
CWE ID-CWE-703
Improper Check or Handling of Exceptional Conditions
CVE-2022-20924
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-7.7||HIGH
EPSS-0.12% / 31.64%
||
7 Day CHG~0.00%
Published-10 Nov, 2022 | 17:30
Updated-03 Aug, 2024 | 02:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-firepower_threat_defenseadaptive_security_appliance_softwareCisco Firepower Threat Defense SoftwareCisco Adaptive Security Appliance (ASA) Software
CWE ID-CWE-703
Improper Check or Handling of Exceptional Conditions
CWE ID-CWE-20
Improper Input Validation
CVE-2024-38435
Matching Score-4
Assigner-Israel National Cyber Directorate (INCD)
ShareView Details
Matching Score-4
Assigner-Israel National Cyber Directorate (INCD)
CVSS Score-6.5||MEDIUM
EPSS-0.21% / 43.08%
||
7 Day CHG+0.07%
Published-21 Jul, 2024 | 07:10
Updated-21 Jul, 2025 | 14:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Unitronics Vision PLC - CWE-703: Improper Check or Handling of Exceptional Conditions

Unitronics Vision PLC – CWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service

Action-Not Available
Vendor-Unitronics PLC
Product-visilogicVision PLC
CWE ID-CWE-703
Improper Check or Handling of Exceptional Conditions
CVE-2019-10927
Matching Score-4
Assigner-Siemens
ShareView Details
Matching Score-4
Assigner-Siemens
CVSS Score-6.5||MEDIUM
EPSS-0.61% / 68.76%
||
7 Day CHG~0.00%
Published-13 Aug, 2019 | 18:55
Updated-04 Aug, 2024 | 22:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service condition. The security vulnerability could be exploited by an authenticated attacker with network access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the availability of the affected device.

Action-Not Available
Vendor-Siemens AG
Product-scalance_xp-200_firmwarescalance_xb-200_firmwarescalance_xf-200ba_firmwarescalance_xc-200_firmwarescalance_xc-200scalance_xb-200scalance_xr-300wg_firmwarescalance_xr-300wgscalance_xp-200scalance_xf-200baSCALANCE XR-300WGSCALANCE XF-200BASCALANCE SC-600SCALANCE XP-200SCALANCE XC-200SCALANCE XB-200
CWE ID-CWE-703
Improper Check or Handling of Exceptional Conditions
Details not found