CVE-2013-1892
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the...
CVE-2013-1892 is a medium vulnerability (CVSS 6.0) in Mongodb, published October 1, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 44.5%, the 98th percentile. No source names a fixed version.
- Severity
- 6.0 MediumCVSS 2.0, NVD
- Exploit chance
- 44.5%EPSS, 98th percentile
- Exploitation
- None known3 public exploits
- Fixed in
- No fix listedNo source names one
Description
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mongodbRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 2 CVEs | before 0:1.6.4-6.el6 | 0:1.6.4-6.el6 |
mongodb-debuginfoRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 2 CVEs | before 0:1.6.4-6.el6 | 0:1.6.4-6.el6 |
mongodb-serverRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 2 CVEs | before 0:1.6.4-6.el6 | 0:1.6.4-6.el6 |
pymongoRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 2 CVEs | before 0:1.9-11.el6 | 0:1.9-11.el6 |
pymongo-debuginfoRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 2 CVEs | before 0:1.9-11.el6 | 0:1.9-11.el6 |
python-bsonRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 2 CVEs | before 0:1.9-11.el6 | 0:1.9-11.el6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | MongoDB nativeHelper.apply Remote Code Execution | 2013-03-24 |
| Exploit-DB | MongoDB - nativeHelper.apply Remote Code Execution (Metasploit) | 2013-04-08 |
| Exploit-DB | MongoDB 2.2.3 - nativeHelper.apply Remote Code Execution | 2013-04-08 |
What each source reports
NVD Score used
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.
- Record
CVE-2013-1892- CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.
- Record
CVE-2013-1892- Updated
- 2026-11-02
EUVDEUVD-2013-1890No score
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.
- Record
EUVD-2013-1890- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vv9j-qmgv-fcp5No score
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the...
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.
- Record
GHSA-vv9j-qmgv-fcp5- Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
rhn.redhat.com/errata/RHSA-2013-1170.html
exploit-db.com/exploits/24947
openwall.com/lists/oss-security/2013/03/25/9
lists.fedoraproject.org/pipermail/package-announce/2013-April/101630.html
blog.scrt.ch/2013/03/24/mongodb-0-day-ssji-to-rce
Show 15 moreShow less
jira.mongodb.org/browse/SERVER-9124
mongodb.org/about/alerts
nvd.nist.gov/vuln/detail/CVE-2013-1892
access.redhat.com/errata/RHSA-2013:1170
bugzilla.redhat.com/show_bug.cgi?id=927536
github.com/advisories/GHSA-vv9j-qmgv-fcp5
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1170.json
cve.org/CVERecord?id=CVE-2013-1892