-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.mongodb:mongodb-driver | maven | >= 3.11.0, <= 3.11.2 | 3.11.3 |
| org.mongodb:mongodb-driver | maven | >= 3.12.0, <= 3.12.7 | 3.12.8 |
| org.mongodb:mongodb-driver-sync | maven | >= 4.0.0, <= 4.0.5 | 4.0.6 |
| org.mongodb:mongodb-driver-sync | maven | >= 4.1.0, <= 4.1.1 | 4.1.2 |
| org.mongodb:mongodb-driver-sync | maven | = 4.2.0 | 4.2.1 |
| org.mongodb:mongo-java-driver | maven | >= 3.11.0, <= 3.11.2 | 3.11.3 |
| org.mongodb:mongo-java-driver | maven | >= 3.12.0, <= 3.12.7 | 3.12.8 |
| org.mongodb:mongodb-driver-legacy | maven | >= 4.0.0, <= 4.0.5 | 4.0.6 |
| org.mongodb:mongodb-driver-legacy | maven | >= 4.1.0, <= 4.1.1 | 4.1.2 |
| org.mongodb:mongodb-driver-legacy | maven | >= 3.11.0, <= 3.11.2 | 3.11.3 |
| org.mongodb:mongodb-driver-legacy | maven | >= 3.12.0, <= 3.12.7 | 3.12.8 |
| org.mongodb:mongodb-driver-sync | maven | >= 3.12.0, <= 3.12.7 | 3.12.8 |
| org.mongodb:mongodb-driver-sync | maven | >= 3.11.0, <= 3.11.2 | 3.11.3 |
| org.mongodb:mongodb-driver-legacy | maven | = 4.2.0 | 4.2.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing hostname verification during KMS SSL handshakes. Analysis of MongoDB's architecture indicates certificate validation would occur in KMS provider implementations. The AbstractKmsProvider class is a likely location for SSL context configuration, and ClientEncryption would be involved in client initialization. The CVE description explicitly calls out missing hostname validation, which maps to SSL context creation points in KMS communication paths. While exact patch details aren't visible, the KMS provider framework and client initialization are the logical locations for this security control based on MongoDB's architecture and the vulnerability description.
KEV Misses 88% of Exploited CVEs- Get the report