CVE-2024-7553highCWE-284

CVE-2024-7553: high-severity vulnerability in MongoDB Server

Accessing Untrusted Directory May Allow Local Privilege Escalation

Published

Follow this CVE+ Monitor MongoDB Server+ Monitor C Driver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 0.3%
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
MongoDB Inc · MongoDB C DriverMongoDB Inc · MongoDB PHP DriverMongoDB Inc · MongoDB Server
Related CVEs — MongoDB Server

In the same product, most dangerous first.

CVE-2023-0437MEDIUMMongoDB client C Driver may infinitely loop when validating certain BSON input dataEPSS 1.1%CVE-2026-25611HIGHPre-Authentication Memory Exhaustion Denial of Service in MongoDB ServerEPSS 0.9%CVE-2025-0755HIGHMongoDB C Driver bson library may be susceptible to buffer overflowEPSS 0.8%CVE-2021-32050MEDIUMSome MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an applicationEPSS 0.6%CVE-2024-8305MEDIUMMongoDB Server secondaries may crash due to forced index constraintsEPSS 0.6%CVE-2024-10921MEDIUMImproper neutralization of null bytes may lead to buffer over-reads in MongoDB ServerEPSS 0.6%