« Volver al listado

CVE-2014-3971

Estado: ModificadaMedia (5)—

The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mongodb — Mongodb

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-3971",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-12-25T11:59:00.037",
  "references": [
    {
      "url": "https://github.com/mongodb/mongo/commit/c151e0660b9736fe66b224f1129a16871165251b",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://jira.mongodb.org/browse/SERVER-13753",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/mongodb/mongo/commit/c151e0660b9736fe66b224f1129a16871165251b",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jira.mongodb.org/browse/SERVER-13753",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate."
    },
    {
      "lang": "es",
      "value": "La función CmdAuthenticate::_authenticateX509 en db/commands/authentication_commands.cpp en mongod en MongoDB 2.6.x anterior a 2.6.2 permite a atacantes remotos causar una denegación de servicio (caída del demonio) intentando autenticarse con un certificado cliente X.509 inválido."
    }
  ],
  "lastModified": "2026-06-17T00:09:13.550",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:2.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E60BA295-06A2-418F-9FBC-C8DBB42AA044"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:2.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B21D4014-E2DB-4C9C-9491-B77BDA243DCE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}