Unrated severityNVD Advisory· Published Oct 1, 2013· Updated Apr 29, 2026
CVE-2013-1892
CVE-2013-1892
Description
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.
Affected products
18cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*+ 16 more
- cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*range: <=2.0.8
- cpe:2.3:a:mongodb:mongodb:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:1.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:1.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:2.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:mongodb:mongodb:2.2.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_mrg:2.3:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
9- blog.scrt.ch/2013/03/24/mongodb-0-day-ssji-to-rce/nvdExploit
- rhn.redhat.com/errata/RHSA-2013-1170.htmlnvdVendor Advisory
- www.mongodb.org/about/alerts/nvdVendor Advisory
- lists.fedoraproject.org/pipermail/package-announce/2013-April/101630.htmlnvd
- lists.fedoraproject.org/pipermail/package-announce/2013-April/101679.htmlnvd
- www.exploit-db.com/exploits/24935nvd
- www.exploit-db.com/exploits/24947nvd
- www.openwall.com/lists/oss-security/2013/03/25/9nvd
- jira.mongodb.org/browse/SERVER-9124nvd
News mentions
0No linked articles in our index yet.