CVE-2020-24391 describes a critical vulnerability in mongo-express versions prior to 1.0.0, where its implementation of advanced syntax support is unsafe. This flaw allows for unauthenticated remote code execution with high impact on confidentiality, integrity, and availability, as indicated by its CVSS score of 9.8 (Critical). While there's no evidence of active exploitation or Metasploit modules, Nuclei templates exist for remote code execution, and its high EPSS score suggests a significant likelihood of future exploitation. Despite this, there is currently no public community discussion or media coverage surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.54.0CPE matchmatch criteria | cpe:2.3:a:mongo-express_project:mongo-express:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.