- Description
- mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0
- Source
- cna@mongodb.com
- NVD status
- Analyzed
- Products
- mongosh, codeready_linux_builder_eus, codeready_linux_builder_for_arm64_eus, codeready_linux_builder_for_ibm_z_systems_eus, codeready_linux_builder_for_power_little_endian_eus, enterprise_linux_update_services_for_sap_solutions, enterprise_linux_eus, enterprise_linux_for_arm_64, enterprise_linux_for_arm_64_eus, enterprise_linux_for_ibm_z_systems, enterprise_linux_for_ibm_z_systems_eus, enterprise_linux_for_power_little_endian_eus, enterprise_linux_server_aus
CVSS 3.1
- Type
- Primary
- Base score
- 7.8
- Impact score
- 5.9
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- Hype score
- Not currently trending
New post from https://t.co/uXvPWJy6tj (CVE-2025-1756 | MongoDB mongosh up to 2.2.x File C:node_modules untrusted search path (RHSA-2025:1756)) has been published on https://t.co/tU7RWXqtGm
@WolfgangSesin
28 Feb 2025
11 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
MongoDB Compass and Shell may be susceptible to local privilege escalation inWindowsURL: https://t.co/8EGK6uf0NJ: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5CVEs: CVE-2025-1755, CVE-2025-1756See also: https://t.co/4LTNldNJfc
@CharyyevPerman
28 Feb 2025
31 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-1756 Local Privilege Escalation in mongosh Prior to 2.3.0 via Node Modules Directory https://t.co/5cCNyGdgNa
@VulmonFeeds
27 Feb 2025
16 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
⚠️ MongoDB Security Advisory: February 2025 Vulnerabilities *1. Local Privilege Escalation Vulnerabilities* *CVE-2025-1756 (MongoDB Shell)* 📅 Timeline: Disclosure: 2025-02-27 & Patch Release: 2025-02-27 🆔 CVE ID: CVE-2025-1756 📊 CVSS v3.1: Score: 7.5 (High 🟠) Vector:… h
@syedaquib77
27 Feb 2025
18 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mongodb:mongosh:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64C2BFE9-64C0-4711-A311-1DFDFEBE4477",
"versionEndExcluding": "2.3.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C4B0BD8-527F-4728-A64B-F8F06D5EDEC5"
},
{
"criteria": "cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.4_aarch64:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "88F9EB73-1F19-4BD9-AB19-36F9F1A5156E"
},
{
"criteria": "cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "35232613-B8B5-4F4D-A6CD-3823C6666534"
},
{
"criteria": "cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "03A1BB59-4BE6-4339-ABB7-C18B7D899FB9"
},
{
"criteria": "cpe:2.3:a:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F0F1D571-6C70-45D9-BC76-C6DF33967127"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B03506D7-0FCD-47B7-90F6-DDEEB5C5A733"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.4_aarch64:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DBF70805-7EBF-4731-83DB-D71F7A646B0F"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "01363FFA-F7A6-43FC-8D47-E67F95410095"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.4_s390x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "069180B4-BA50-4AD0-8BA9-83F8005E58BE"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F843B777-5C64-4CAE-80D6-89DC2C9515B1"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC3CBA5D-9E5D-4C46-B37E-7BB35BE8DADB"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39D345D3-108A-4551-A112-5EE51991411A"
}
],
"operator": "OR"
}
]
}
]