Description

MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory.

Remediation

References

CVE-2017-15535

Related Vulnerabilities

Joomla Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2011-4912)

WordPress Plugin Simple Link Directory PHP Object Injection (5.5.0)

WordPress Plugin WP Frontend Profile Security Bypass (1.2.1)

CakePHP Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2023-22727)

WordPress Plugin Cookie Notification for WordPress-WP Cookie User Info includes Backdoor [Only if downloaded via the vendor website] (1.0.7)

Severity

Critical

Classification

CVE-2017-15535 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Tags

Missing Update Known Vulnerabilities