MongoDB Server may access a non-initialized region of memory, leading to unexpected behavior when zero arguments are called in the internal aggregation stage. This issue specifically affects MongoDB Server version 6.0.3.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5 | CVE-2024-8654 |
Exploitation
To exploit this vulnerability, an attacker would need to send a specially crafted request to the MongoDB Server that triggers the internal aggregation stage with zero arguments. Given the high attack complexity, this may require specific conditions to be met, but successful exploitation could lead to unexpected behavior in the server.
Affected Products
- MongoDB Server v6.0.3: This version is affected by the vulnerability, which can lead to memory access issues during aggregation operations.
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to a patched version of MongoDB Server that addresses this issue. Additionally, implementing network security measures to restrict access to the database can help reduce the risk of exploitation.