Vulnerabilities > CVE-2021-21422 - Unspecified vulnerability in Mongo-Express Project Mongo-Express

CVSS 6.1 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

NONE

network

low complexity

mongo-express-project

NVD

Published: 2021-06-21

Updated: 2024-11-21

Summary

mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\collection are possible.

Vulnerable Configurations

Part	Description	Count
Application	Mongo-Express_Project Mongo Express Project Mongo Express 0.2.1 Mongo Express Project Mongo Express 0.2.2 Mongo Express Project Mongo Express 0.2.3 Mongo Express Project Mongo Express 0.3.0 Mongo Express Project Mongo Express 0.3.1 Mongo Express Project Mongo Express 0.3.2 Mongo Express Project Mongo Express 0.3.3 Mongo Express Project Mongo Express 0.3.4 Mongo Express Project Mongo Express 0.4.0 Mongo Express Project Mongo Express 0.5.0 Mongo Express Project Mongo Express 0.6.0 Mongo Express Project Mongo Express 0.7.0 Mongo Express Project Mongo Express 0.7.1 Mongo Express Project Mongo Express 0.8.0 Mongo Express Project Mongo Express 0.8.1 Mongo Express Project Mongo Express 0.9.0 Mongo Express Project Mongo Express 0.10.0 Mongo Express Project Mongo Express 0.11.0 Mongo Express Project Mongo Express 0.11.1 Mongo Express Project Mongo Express 0.11.2 Mongo Express Project Mongo Express 0.11.3 Mongo Express Project Mongo Express 0.12.0 Mongo Express Project Mongo Express 0.13.0 Mongo Express Project Mongo Express 0.14.0 Mongo Express Project Mongo Express 0.14.1 Mongo Express Project Mongo Express 0.15.0 Mongo Express Project Mongo Express 0.16.0 Mongo Express Project Mongo Express 0.16.1 Mongo Express Project Mongo Express 0.17.0 Mongo Express Project Mongo Express 0.17.1 Mongo Express Project Mongo Express 0.17.2 Mongo Express Project Mongo Express 0.17.3 Mongo Express Project Mongo Express 0.17.4 Mongo Express Project Mongo Express 0.17.5 Mongo Express Project Mongo Express 0.27.4 Mongo Express Project Mongo Express 0.29.10 Mongo Express Project Mongo Express 0.32.0 Mongo Express Project Mongo Express 0.33.0 Mongo Express Project Mongo Express 0.34.0 Mongo Express Project Mongo Express 0.35.0 Mongo Express Project Mongo Express 0.37.0 Mongo Express Project Mongo Express 0.37.1 Mongo Express Project Mongo Express 0.37.2 Mongo Express Project Mongo Express 0.38.0 Mongo Express Project Mongo Express 0.39.0 Mongo Express Project Mongo Express 0.39.1 Mongo Express Project Mongo Express 0.39.2 Mongo Express Project Mongo Express 0.40.0 Mongo Express Project Mongo Express 0.41.0 Mongo Express Project Mongo Express 0.42.0 Mongo Express Project Mongo Express 0.42.1 Mongo Express Project Mongo Express 0.42.2 Mongo Express Project Mongo Express 0.42.3 Mongo Express Project Mongo Express 0.43.0 Mongo Express Project Mongo Express 0.43.1 Mongo Express Project Mongo Express 0.44.0 Mongo Express Project Mongo Express 0.45.0 Mongo Express Project Mongo Express 0.46.0 Mongo Express Project Mongo Express 0.46.1 Mongo Express Project Mongo Express 0.47.0 Mongo Express Project Mongo Express 0.48.0 Mongo Express Project Mongo Express 0.48.1 Mongo Express Project Mongo Express 0.49.0 Mongo Express Project Mongo Express 0.50.0 Mongo Express Project Mongo Express 0.51.0 Mongo Express Project Mongo Express 0.51.1 Mongo Express Project Mongo Express 0.51.2 Mongo Express Project Mongo Express 0.52.0 Mongo Express Project Mongo Express 0.52.1 Mongo Express Project Mongo Express 0.52.2 Mongo Express Project Mongo Express 0.53.0 Mongo Express Project Mongo Express 0.54.0 Mongo Express Project Mongo Express 1.0.0	74

Summary

Vulnerable Configurations

References