Vulnerability · Published Mar 30, 2020 · Assigned by snyk
CVE-2020-7610
Critical 9.8
In plain English
A critical-severity security flaw in bson. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.3%top 16.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-mongodb | 3.5.6+~cs11.12.19-1 | DEBIAN-CVE-2020-7610 |
| npm | bson | 1.1.4 | GHSA-v8w9-2789-6hhr |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-JS-BSON-561052 x_refsource_MISC