CVE-2025-1692 (GCVE-0-2025-1692)
Vulnerability from cvelistv5
Published
2025-02-27 12:37
Modified
2025-02-27 15:19
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Summary
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MongoDB Inc | mongosh |
Version: 0 < 2.3.9 cpe:2.3:a:mongodb:mongosh:0.2.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.3.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.4.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.4.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.5.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.5.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.6.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.7.7:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.8.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.8.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.8.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.9.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.10.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.10.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.11.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.12.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.12.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.13.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.14.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.15.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.15.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:0.15.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.0.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.0.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.0.5:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.0.6:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.0.7:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.1.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.1.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.1.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.1.5:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.1.6:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.1.7:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.1.8:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.1.9:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.2.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.2.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.2.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.3.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.4.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.4.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.5.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.5.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.5.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.5.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.5.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.6.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.6.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.6.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.7.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.7.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.8.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.8.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.90:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.91:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.10.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.10.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.10.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.10.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.10.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.10.5:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:1.10.6:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.0.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.0.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.0.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.1.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.1.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.1.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.1.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.1.5:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.2.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.2.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.2.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.2.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.2.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.2.5:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.2.6:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.2.9:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.2.10:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.2.11:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.2.12:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.2.15:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.3.1:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.3.2:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.3.3:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.3.4:*:*:*:*:*:*:* cpe:2.3:a:mongodb:mongosh:2.3.8:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1692",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-27T14:31:11.143757Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-27T14:31:37.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mongodb:mongosh:0.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.5.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.7.7:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.8.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.8.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.8.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.10.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.10.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.11.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.12.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.12.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.13.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.14.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.15.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.15.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:0.15.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.1.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.1.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.1.5:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.1.6:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.1.7:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.1.8:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.1.9:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.5.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.5.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.5.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.7.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.7.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.8.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.8.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.90:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.91:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.10.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.10.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.10.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.10.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.10.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.10.5:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:1.10.6:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.1.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.1.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.1.5:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.2.9:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.2.10:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.2.11:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.2.12:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.2.15:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.3.3:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.3.4:*:*:*:*:*:*:*",
"cpe:2.3:a:mongodb:mongosh:2.3.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "mongosh",
"vendor": "MongoDB Inc",
"versions": [
{
"lessThan": "2.3.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2025-02-27T12:35:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe MongoDB Shell may be susceptible to control character injection where an attacker with control of the user\u2019s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user\u2019s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-27T15:19:13.933Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://jira.mongodb.org/browse/MONGOSH-2025"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MongoDB Shell may be susceptible to control character injection via pasting",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2025-1692",
"datePublished": "2025-02-27T12:37:00.376Z",
"dateReserved": "2025-02-25T13:44:14.148Z",
"dateUpdated": "2025-02-27T15:19:13.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-1692\",\"sourceIdentifier\":\"cna@mongodb.com\",\"published\":\"2025-02-27T13:15:11.413\",\"lastModified\":\"2025-02-27T13:15:11.413\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user\u2019s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9\"},{\"lang\":\"es\",\"value\":\"El shell de MongoDB puede ser susceptible a la inyecci\u00f3n de caracteres de control, donde un atacante con control del portapapeles del usuario podr\u00eda manipularlo para pegar texto en Mongosh que eval\u00faa c\u00f3digo arbitrario. Los caracteres de control en el texto pegado se pueden utilizar para ofuscar c\u00f3digo malicioso. Este problema afecta a las versiones de Mongosh anteriores a la 2.3.9.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@mongodb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.3,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"cna@mongodb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-150\"}]}],\"references\":[{\"url\":\"https://jira.mongodb.org/browse/MONGOSH-2025\",\"source\":\"cna@mongodb.com\"}]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"affected\": [{\"cpes\": [\"cpe:2.3:a:mongodb:mongosh:0.2.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.3.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.4.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.4.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.5.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.5.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.6.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.7.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.8.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.8.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.8.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.9.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.10.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.10.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.11.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.12.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.12.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.13.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.14.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.15.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.15.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:0.15.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.0.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.0.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.0.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.0.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.0.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.1.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.1.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.1.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.1.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.1.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.1.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.1.8:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.1.9:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.2.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.2.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.2.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.3.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.4.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.4.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.5.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.5.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.5.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.5.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.5.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.6.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.6.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.6.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.7.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.7.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.8.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.8.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.90:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.91:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.10.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.10.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.10.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.10.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.10.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.10.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:1.10.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.1.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.1.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.1.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.1.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.1.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.2.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.2.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.2.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.2.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.2.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.2.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.2.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.2.9:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.2.10:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.2.11:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.2.12:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.2.15:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.3.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.3.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.3.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.3.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.3.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongosh:2.3.8:*:*:*:*:*:*:*\"], \"defaultStatus\": \"unaffected\", \"product\": \"mongosh\", \"vendor\": \"MongoDB Inc\", \"versions\": [{\"lessThan\": \"2.3.9\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}], \"datePublic\": \"2025-02-27T12:35:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eThe MongoDB Shell may be susceptible to control character injection where an attacker with control of the user\\u2019s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9\u003c/span\u003e\u003cbr\u003e\"}], \"value\": \"The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user\\u2019s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-150\", \"description\": \"CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"a39b4221-9bd0-4244-95fc-f3e2e07f1deb\", \"shortName\": \"mongodb\", \"dateUpdated\": \"2025-02-27T15:19:13.933Z\"}, \"references\": [{\"url\": \"https://jira.mongodb.org/browse/MONGOSH-2025\"}], \"source\": {\"discovery\": \"EXTERNAL\"}, \"title\": \"MongoDB Shell may be susceptible to control character injection via pasting\", \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-1692\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T14:31:11.143757Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T14:31:17.301Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2025-1692\", \"assignerOrgId\": \"a39b4221-9bd0-4244-95fc-f3e2e07f1deb\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"mongodb\", \"dateReserved\": \"2025-02-25T13:44:14.148Z\", \"datePublished\": \"2025-02-27T12:37:00.376Z\", \"dateUpdated\": \"2025-02-27T15:19:13.933Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…