← Back

CVE-2025-3085

nvd nist
Published: Apr 1, 2025Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-cluster authentication. This issue affects MongoDB Server v5.0 versions prior to 5.0.31, MongoDB Server v6.0 versions prior to 6.0.20, MongoDB Server v7.0 versions prior to 7.0.16 and MongoDB Server v8.0 versions prior to 8.0.4. Required Configuration : MongoDB Server must be running on Linux Operating Systems and CRL revocation status checking must be enabled

Affected (4)

Products: Mongodb: Mongodb
Mongodb
1 product
Mongodb
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Mongodb
Mongodb
From 5.0.0 to 5.0.31
Mongodb
From 6.0.0 to 6.0.20
Mongodb
From 7.0.0 to 7.0.16
Mongodb
From 8.0.0 to 8.0.4

Related CWEs

CWE-299
Improper Check for Certificate Revocation
The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

References (1)

Source: cna@mongodb.com
Vendor Advisory

Timeline

No history available yet.