超危
mongo-express远程代码执行漏洞
2019-12-24 21:08:36 公开 ，2026-02-20 19:52:16 更新
- 关键漏洞
- CISA KEV
- 勒索软件漏洞
- APT漏洞
- 远程
- 公开PoC
- CWE Top 25 (2023)
- 开源组件漏洞
- 2024两高一弱互联网漏洞
- CWE Top 25 (2024)
- 2025两高一弱漏洞
- SSVC：
- 可利用状态：已被积极利用攻击自动化：否技术影响评估：全部 2025-02-07 20:54:06
风险信息
- CVSS v2 向量
- AV:N/AC:L/Au:S/C:C/I:C/A:C
- CVSS v2 风险值
- 9
- CVSS v3 向量
- AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS v3 风险值
- 9.9
- CVSS v3.1 向量
- AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS v3.1 风险值
- 9.9
详细信息
- 漏洞类型
- 其他
- 漏洞描述
- mongo-express是一款用于交互式管理MongoDB数据库的、基于Web的轻量级管理界面。mongo express 0.54.0之前的版本容易通过使用toBSON方法的端点执行远程代码。在不安全的环境中滥用vm依赖项来执行exec命令。
- 修复建议
- 有关补丁、升级或建议的解决方法信息，请参阅mongo express GIT存储库： https://github.com/mongo-express/mongo-express/security/advisories/GHSA-h47j-hc6x-h3qq
参考链接
- https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215
OSV · x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2019-10758
OSV
- http://example.com
GitHub
- https://github.com/mongo-express/mongo-express/security/advisories/GHSA-h47j-hc6x-h3qq
OSV
- https://github.com/mongo-express/mongo-express/pull/522
OSV
- https://github.com/mongo-express/mongo-express/commit/7d365141deadbd38fa961cd835ce68eab5731494
OSV
- https://github.com/advisories/GHSA-h47j-hc6x-h3qq
GitHub
- https://osv.dev/vulnerability/GHSA-h47j-hc6x-h3qq
OSV
- https://osv.dev/vulnerability/CVE-2019-10758
OSV
- https://github.com/mongo-express/mongo-express/commit/d8c9bda46a204ecba1d35558452685cd0674e6f2
OSV
- https://github.com/mongo-express/mongo-express
OSV
- https://github.com/mongo-express/mongo-express/blob/ea02b364d43f179f191fc91fb9962efdb0843a8d/lib/bson.js#L60
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10758
OSV · US Government Resource