CVE-2025-3084
Last modified
CVE-2025-3084 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. EPSS estimates a 0.37% chance of exploitation in the next 30 days.
Description
When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mongodb | Mongodb | >= 5.0.0, < 5.0.31 |
| Mongodb | Mongodb | >= 6.0.0, < 6.0.20 |
| Mongodb | Mongodb | >= 7.0.0, < 7.0.16 |
| Mongodb | Mongodb | >= 8.0.0, < 8.0.4 |
References
- https://jira.mongodb.org/browse/SERVER-103153Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-3084?
How severe is CVE-2025-3084?
How do I fix CVE-2025-3084?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-30834Path Traversal: '.../...//' vulnerability in Bit Apps Bit As…7.5
- CVE-2025-30835Improper Control of Filename for Include/Require Statement i…7.5
- CVE-2025-30836Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-30837Improper Neutralization of Input During Web Page Generation …7.1
- CVE-2025-30838Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-30839Missing Authorization vulnerability in magepeopleteam Taxi B…5.3
- CVE-2025-30840Improper Neutralization of Input During Web Page Generation …7.1
- CVE-2025-30841Improper Limitation of a Pathname to a Restricted Directory …9.9
- CVE-2025-30842Cross-Site Request Forgery (CSRF) vulnerability in pixolette…4.3
- CVE-2025-30843Improper Neutralization of Special Elements used in an SQL C…7.6
- CVE-2025-30844Improper Neutralization of Input During Web Page Generation …6.1
- CVE-2025-30845Improper Control of Filename for Include/Require Statement i…7.5
Are you affected by CVE-2025-3084?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST