CVE-2024-3371: compass — Fix

Description

MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.

Is your site exposed to CVE-2024-3371?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.1

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness Type (CWE)

CWE-360 CWE-360

Affected Products

Vendor	Product	Versions
mongodb	compass	1.35.0 — 1.42.1

References

Advisories & Patches

https://jira.mongodb.org/browse/COMPASS-7260 https://jira.mongodb.org/browse/COMPASS-7260

Frequently Asked Questions

What is CVE-2024-3371? +

MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0. It has a CVSS v3.1 base score of 7.1 (HIGH).

How severe is CVE-2024-3371? +

CVE-2024-3371 has a CVSS v3.1 score of 7.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-3371? +

CVE-2024-3371 affects products from mongodb, specifically: compass. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-3371? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-93762 9.8

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally …

CVE-2024-1351 8.8

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections …

CVE-2026-8053 8.8

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds …

CVE-2026-93759 8.6

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database …

CVE-2025-0755 8.4

The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that …

CVE-2026-88033 8.3

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause …

CVE-2024-3371