CVE-2025-3082
Last modified
CVE-2025-3082 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version prior to 7.0.14 and MongoDB Server v7.3 versions prior to 7.3.4.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version prior to 7.0.14 and MongoDB Server v7.3 versions prior to 7.3.4.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mongodb | Mongodb | >= 5.0.0, < 5.0.31 |
| Mongodb | Mongodb | >= 6.0.0, < 6.0.20 |
| Mongodb | Mongodb | >= 7.0.0, < 7.0.14 |
| Mongodb | Mongodb | >= 7.3.0, < 7.3.4 |
References
- https://jira.mongodb.org/browse/SERVER-103151Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-3082?
How severe is CVE-2025-3082?
How do I fix CVE-2025-3082?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-30814Improper Control of Filename for Include/Require Statement i…7.5
- CVE-2025-30815Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sat…4.3
- CVE-2025-30816Cross-Site Request Forgery (CSRF) vulnerability in Nks publi…4.3
- CVE-2025-30817Missing Authorization vulnerability in wpzita Z Companion z-…5.4
- CVE-2025-30818Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-30819Improper Neutralization of Special Elements used in an SQL C…8.5
- CVE-2025-30820Improper Control of Filename for Include/Require Statement i…7.5
- CVE-2025-30821Missing Authorization vulnerability in otacke SNORDIAN's H5P…5.3
- CVE-2025-30822Cross-Site Request Forgery (CSRF) vulnerability in Hakik Zam…4.3
- CVE-2025-30823Cross-Site Request Forgery (CSRF) vulnerability in Boone Gor…4.3
- CVE-2025-30824Missing Authorization vulnerability in Israpil Textmetrics w…5.4
- CVE-2025-30825Missing Authorization vulnerability in WPClever WPC Smart Li…8.8
Are you affected by CVE-2025-3082?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST