CVE-2024-3371 Insufficient validation of external input in Compass may enable MITM attacks
Insufficient input validation in MongoDB Compass allows MITM attacks leading to data disclosure and user impersonation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3371?
CVE-2024-3371 is a high-severity vulnerability in MongoDB Compass, published on 24 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.
Weakness: CWE-360
Which versions are affected by CVE-2024-3371?
It affects 1 product.
Products include Mongodb Compass.
How do I fix CVE-2024-3371?
No fix has been published for CVE-2024-3371 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-3371 being exploited?
There is no known exploitation of CVE-2024-3371 in the wild and no public exploit code.
Other vulnerabilities in MongoDB Compass
- CVE-2026-14881 Command injection in MongoDB Compass
- CVE-2025-1755 MongoDB Compass may be susceptible to local privilege escalation in Windows
- CVE-2024-6376 ejson shell parser in MongoDB Compass maybe bypassed
- CVE-2026-9101 Prototype pollution in csv parsing
- CVE-2021-20334 Local privilege escalation in MongoDB Compass for Windows
Sources
Also known as GHSA-838g-cpgm-j985.