Cyber Resilience

CVE-2024-3371

Mongodb Compass 1.35.0 – 1.42.1

Published
24 April 2024
Modified
06 February 2025
Patch / advisory
View advisory
CVSS Score v3.1 7.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0023 14th percentile
Risk Priority 51 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-3371 is a high-severity Trust of System Event Data (CWE-360) vulnerability in Mongodb Compass. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AU-10 (Non-repudiation) and SC-16 (Transmission of Security and Privacy Attributes) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.

CWE(s)
CWE-360NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
attack.mitre.org →
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-6376Same product: Mongodb Compass
CVE-2025-11695Same vendor: Mongodb
CVE-2025-3085Same vendor: Mongodb
CVE-2026-13066Same vendor: Mongodb
CVE-2025-7259Same vendor: Mongodb
CVE-2026-13076Same vendor: Mongodb
CVE-2025-3084Same vendor: Mongodb
CVE-2026-9742Same vendor: Mongodb
CVE-2026-13063Same vendor: Mongodb
CVE-2025-13507Same vendor: Mongodb

Affected Assets

mongodb
compass
1.35.0 — 1.42.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AU-10 Non-repudiation partial match

Non-repudiation reduces blast radius when event data has been spoofed by supplying irrefutable proof.

SC-16 Transmission of Security and Privacy Attributes partial match

Binding security attributes to exchanged information prevents blind trust in unauthenticated event data.

SC-23 Session Authenticity partial match

Session authenticity mechanisms stop security decisions from being based on spoofable event data.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

RS.AN-07 mostly match
prevents

Preserving integrity and provenance of incident/event data directly reduces reliance on spoofable single-source events.

DE.AE-03 partial match
prevents

Correlation across sources can surface inconsistencies that indicate spoofed event data.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.15 Logging partial match
finds

Logging can capture event data but does not inherently validate its authenticity against spoofing.

A.8.16 Monitoring activities partial match
finds

Monitoring activities may detect anomalies in event data but do not guarantee the trustworthiness of the source.

A.8.17 Clock synchronization partial match
degrades

Clock synchronization supports event correlation but does not prevent spoofed event data.

A.8.20 Networks security partial match
mitigates

Network security controls can limit spoofing vectors but do not fully address trust in system event data.

A.8.24 Use of cryptography partial match
prevents

Cryptography can protect event integrity and authenticity but is not explicitly required by the control for this purpose.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles can include event validation mechanisms but do not mandate them.

References