CVE-2025-1693
MongoDB Shell may be susceptible to control character Injection via shell output
3.9
LOW
CVSS 3.1
EPSS 0.19%
描述
The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages that appear to originate from mongosh or the underlying operating system, potentially misleading users into executing unsafe actions. The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker. This issue affects mongosh versions prior to 2.3.9.
如何修補 CVE-2025-1693
要修補 CVE-2025-1693,請將受影響套件升級到下列已修補版本。
- —升級至 2.3.9 或更新版本
CVE-2025-1693 正在被利用嗎?
低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 2.3.9
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | LOW3.9 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L |