CVE-2025-3085
April 01, 2025
A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-cluster authentication. This issue affects MongoDB Server v5.0 versions prior to 5.0.31, MongoDB Server v6.0 versions prior to 6.0.20, MongoDB Server v7.0 versions prior to 7.0.16 and MongoDB Server v8.0 versions prior to 8.0.4.
Required Configuration : MongoDB Server must be running on Linux Operating Systems and CRL revocation status checking must be enabled
Affected Packages
https://github.com/mongodb/mongo.git (GITHUB):
Affected version(s) >=r7.0.0 <r7.0.16Fix Suggestion:
Update to version r7.0.16https://github.com/mongodb/mongo.git (GITHUB):
Affected version(s) >=r5.0.0 <r5.0.31Fix Suggestion:
Update to version r5.0.31https://github.com/mongodb/mongo.git (GITHUB):
Affected version(s) >=r6.0.0 <r6.0.20Fix Suggestion:
Update to version r6.0.20https://github.com/mongodb/mongo.git (GITHUB):
Affected version(s) >=r8.0.0 <https://github.com/mongodb/mongo/commit/44abf55175c833027aae9d6010f0d0bffa63a968Fix Suggestion:
Update to version https://github.com/mongodb/mongo/commit/44abf55175c833027aae9d6010f0d0bffa63a968Related Resources (1)
Do you need more information?
Contact UsCVSS v4
Base Score:
9.2
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Improper Check for Certificate Revocation
EPSS
Base Score:
0.16
