VDB
CVE-2013-3969
CVE-2013-3969
PUBLISHED
CVSS 6.5 MEDIUM
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary code via an invalid RefDB object.
EPSS 10.11% · 95.6th percentile
Risk Scores
CVSS 2.0
6.5
EPSS Score
10.11%
95.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| mongodb | mongodb | 2.4.0, 2.4.1, 2.4.2 |
Timeline
- Jun 4, 2013 PoC Published
- Oct 1, 2013 CVE Published
- Feb 4, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Feb 10, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 26, 2023 EPSS Score
- Sep 9, 2023 EPSS Score
- Nov 1, 2023 EPSS Score
- Feb 8, 2024 EPSS Score
References
- http://www.mongodb.org/about/alerts/ url
- [oss-security] 20130730 Re: CVE Request - MongoDB <=2.4.4 uninitialized object mailing-list
- http://blog.scrt.ch/2013/06/04/mongodb-rce-by-databasespraying/ url
- 54170 third-party-advisory
- https://jira.mongodb.org/browse/SERVER-9878 url
- https://nvd.nist.gov/vuln/detail/CVE-2013-3969 advisory
- http://blog.scrt.ch/2013/06/04/mongodb-rce-by-databasespraying url
- http://www.mongodb.org/about/alerts url