What is GHSA-hxmg-hm46-cf62?

GHSA-hxmg-hm46-cf62 is a security advisory published by GitHub Security Advisories with Critical severity. Remote code execution in mongo-express

Which CVE IDs does GHSA-hxmg-hm46-cf62 cover?

GHSA-hxmg-hm46-cf62 covers the following CVE IDs: CVE-2020-24391. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hxmg-hm46-cf62?

GHSA-hxmg-hm46-cf62 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-hxmg-hm46-cf62?

GHSA-hxmg-hm46-cf62 affects 1 product, including: npm/mongodb-query-parser:\u003c 2.0.0.

GHSA-hxmg-hm46-cf62CriticalCVSS 9.8

Remote code execution in mongo-express

Vendor

GitHub Security Advisories

Published

April 13, 2021

Last Modified

September 12, 2023

🔗 CVE IDs covered (1)

CVE-2020-24391 →

📋 Description

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.

🎯 Affected products1

npm/mongodb-query-parser:< 2.0.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-24391
https://github.com/mongodb-js/query-parser/issues/16
https://github.com/mongo-express/mongo-express/commit/3a26b079e7821e0e209c3ee0cc2ae15ad467b91a
https://github.com/advisories/GHSA-hxmg-hm46-cf62