CVE-2025-10491highCWE-284

MongoDB Windows installation MSI may leave ACLs unset on custom installation directories

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.8epss 0.1%

probabilidade de exploração

0.1%top 98% das CVEs

exploração observada

nãonenhuma fonte reporta

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

MongoDB Inc · MongoDB Server

Referências

https://jira.mongodb.org/browse/SERVER-51366