Remote code execution in mongo-express

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-24391 · ADVISORY
• mongodb-js/query-parser · WEB
• mongo-express/mongo-express commit 3a26b07 · WEB

mongo-express のその他の脆弱性

• CVE-2023-52555中 6.1In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.
• CVE-2021-21422中 6.1mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mo…
• CVE-2019-10758緊急 9.9悪用確認済み（CISA KEV）mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` depende…