Cyber Resilience

CVE-2024-3371

Mongodb Compass 1.35.0 – 1.42.1

Published
24 April 2024
Modified
06 February 2025
Patch / advisory
CVSS Score v3.1 7.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0023 14th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2024-3371 is a high-severity Trust of System Event Data (CWE-360) vulnerability in Mongodb Compass. Its CVSS base score is 7.1 (High).

Operationally, ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.

CWE(s)

Related Threats

CVEs Like This One

CVE-2024-6376Same product: Mongodb Compass
CVE-2026-5170Same vendor: Mongodb
CVE-2026-8199Same vendor: Mongodb
CVE-2026-9740Same vendor: Mongodb
CVE-2026-9749Same vendor: Mongodb
CVE-2026-6914Same vendor: Mongodb
CVE-2026-6231Same vendor: Mongodb
CVE-2023-0437Same vendor: Mongodb
CVE-2026-1850Same vendor: Mongodb
CVE-2026-9748Same vendor: Mongodb

Affected Assets

mongodb
compass
1.35.0 — 1.42.1

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

RS.AN-07 mostly match
prevents

Preserving integrity and provenance of incident/event data directly reduces reliance on spoofable single-source events.

DE.AE-03 partial match
prevents

Correlation across sources can surface inconsistencies that indicate spoofed event data.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.15 Logging partial match
detects

Logging can capture event data but does not inherently validate its authenticity against spoofing.

detects

Monitoring activities may detect anomalies in event data but do not guarantee the trustworthiness of the source.

degrades

Clock synchronization supports event correlation but does not prevent spoofed event data.

mitigates

Network security controls can limit spoofing vectors but do not fully address trust in system event data.

prevents

Cryptography can protect event integrity and authenticity but is not explicitly required by the control for this purpose.

prevents

Secure architecture principles can include event validation mechanisms but do not mandate them.

References