CVE-2020-24391

Published March 30th, 2021

View on NVD ↗

CVSS v3

9.8

CRITICAL

CVSS v2

7.5

HIGH

Affected

2

PROJECTS

Description

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.

mongodb-js/query-parserUNAVAILABLE

Safe parsing and validation for MongoDB queries (filters), projections, and more.

GitHub

37

mongo-express/mongo-express

Web-based MongoDB admin interface, written with Node.js and Express

GitHub

5.97K