Back to CVE Browser

CVE-2020-24391

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1610%

EPSS Percentile36.78th

PublishedMar 30, 2021

Last ModifiedNov 21, 2024

Vulnerability Description

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.

Affected Platforms (CPE)

📦

Mongo Express Project

Mongo Express

<= 0.54.0

References & Advisories

🔗 https://github.com/mongo-express/mongo-express/commit/3a26b079e7821e0e209c3ee0cc2ae15ad467b91a

🔗 https://github.com/mongodb-js/query-parser/issues/16

🔗 https://github.com/mongo-express/mongo-express/commit/3a26b079e7821e0e209c3ee0cc2ae15ad467b91a

🔗 https://github.com/mongodb-js/query-parser/issues/16

Related Vulnerabilities

CVE-2019-107589.9

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `v...

CVE-2021-214228.1

mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://git...

CVE-2021-233724.4

All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to ...

CVE-2026-121917.8

A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdri...