Vulnerability-Lookup

WID-SEC-W-2025-2803

Vulnerability from csaf_certbund - Published: 2025-12-09 23:00 - Updated: 2025-12-09 23:00

Summary

MongoDB: Schwachstelle ermöglicht Beeinträchtigung von Integrität und Verfügbarkeit

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

MongoDB ist ein Open-Source-Dokumentendatenbank.

Angriff

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MongoDB ausnutzen, um die Integrität und Verfügbarkeit zu beeinträchtigen.

Betroffene Betriebssysteme

- Linux - MacOS X - Sonstiges - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "niedrig"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "MongoDB ist ein Open-Source-Dokumentendatenbank.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MongoDB ausnutzen, um die Integrit\u00e4t und Verf\u00fcgbarkeit zu beeintr\u00e4chtigen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2803 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2803.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2803 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2803"
      },
      {
        "category": "external",
        "summary": "EU Vulnerability Database EUVD-2025-201945 vom 2025-12-09",
        "url": "https://euvd.enisa.europa.eu/enisa/EUVD-2025-201945"
      },
      {
        "category": "external",
        "summary": "MongoDB Core Server Issue SERVER-106075 vom 2025-12-09",
        "url": "https://jira.mongodb.org/browse/SERVER-106075"
      }
    ],
    "source_lang": "en-US",
    "title": "MongoDB: Schwachstelle erm\u00f6glicht Beeintr\u00e4chtigung von Integrit\u00e4t und Verf\u00fcgbarkeit",
    "tracking": {
      "current_release_date": "2025-12-09T23:00:00.000+00:00",
      "generator": {
        "date": "2025-12-10T10:45:01.090+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2025-2803",
      "initial_release_date": "2025-12-09T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-12-09T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Server \u003c8.3.0-rc0",
                "product": {
                  "name": "Open Source MongoDB Server \u003c8.3.0-rc0",
                  "product_id": "T047849"
                }
              },
              {
                "category": "product_version",
                "name": "Server 8.3.0-rc0",
                "product": {
                  "name": "Open Source MongoDB Server 8.3.0-rc0",
                  "product_id": "T047849-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:server__8.3.0-rc0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Server \u003c7.0.26",
                "product": {
                  "name": "Open Source MongoDB Server \u003c7.0.26",
                  "product_id": "T048882"
                }
              },
              {
                "category": "product_version",
                "name": "Server 7.0.26",
                "product": {
                  "name": "Open Source MongoDB Server 7.0.26",
                  "product_id": "T048882-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:server__7.0.26"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Server \u003c8.0.16",
                "product": {
                  "name": "Open Source MongoDB Server \u003c8.0.16",
                  "product_id": "T048883"
                }
              },
              {
                "category": "product_version",
                "name": "Server 8.0.16",
                "product": {
                  "name": "Open Source MongoDB Server 8.0.16",
                  "product_id": "T048883-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:server__8.0.16"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Server \u003c8.2.2",
                "product": {
                  "name": "Open Source MongoDB Server \u003c8.2.2",
                  "product_id": "T048884"
                }
              },
              {
                "category": "product_version",
                "name": "Server 8.2.2",
                "product": {
                  "name": "Open Source MongoDB Server 8.2.2",
                  "product_id": "T048884-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:server__8.2.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "MongoDB"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14345",
      "product_status": {
        "known_affected": [
          "T047849",
          "T048883",
          "T048882",
          "T048884"
        ]
      },
      "release_date": "2025-12-09T23:00:00.000+00:00",
      "title": "CVE-2025-14345"
    }
  ]
}

CVE-2025-14345 (GCVE-0-2025-14345)

Vulnerability from cvelistv5 – Published: 2025-12-09 15:00 – Updated: 2025-12-09 15:12

Title

Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server

Summary

A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact. This issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2.

Severity ?

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-667 - Improper Locking

Assigner

mongodb

References

URL

Tags

https://jira.mongodb.org/browse/SERVER-106075

Impacted products

	Vendor	Product	Version
	MongoDB Inc.	MongoDB Server	Affected: 7.0 , < 7.0.26 (custom) Affected: 8.0 , < 8.0.16 (custom) Affected: 8.2 , < 8.2.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14345",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-09T15:11:58.029478Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-09T15:12:28.954Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MongoDB Server",
          "vendor": "MongoDB Inc.",
          "versions": [
            {
              "lessThan": "7.0.26",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0.16",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.2.2",
              "status": "affected",
              "version": "8.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003e\u003cp\u003e\u003c/p\u003e\u003c/b\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eA \u003cspan style=\"background-color: transparent;\"\u003epost-authentication\u003c/span\u003e\u003cb\u003e\u003cspan style=\"background-color: transparent;\"\u003e\u0026nbsp;\u003c/span\u003e\u003c/b\u003eflaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eThis issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2.\u003c/span\u003e\u003c/p\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "A post-authentication\u00a0flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact.\n\nThis issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-667",
              "description": "CWE-667 Improper Locking",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-09T15:00:38.746Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/SERVER-106075"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2025-14345",
    "datePublished": "2025-12-09T15:00:38.746Z",
    "dateReserved": "2025-12-09T14:49:42.517Z",
    "dateUpdated": "2025-12-09T15:12:28.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2025-2803

CVE-2025-14345 (GCVE-0-2025-14345)

Tags

Sightings

Nomenclature