MongoDB Bson vulnerabilities

2 CVEs affecting MongoDB Bson, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-7610, published 2020-03-30.

More from MongoDB.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-4411, published 2020-02-20. High severity, CVSS 7.5. EPSS: 6.4% chance of exploitation in the next 30 days. The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted…
• CVE-2020-7610, published 2020-03-30. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is…