Skip to content
Fencer Intel
medium 6.4

CVE-2012-6619 json

The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of…

published 2014-03-06 12 y ago modified 2026-06-16 4 mo ago also EUVD-2012-6465

cvss
6.4
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.9%
EPSS 3.9% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read.

Patch / fix

  • v8 satellite capsule 6.0, satellite 6.0 1:3.14.5.10-9.el6sat
  • v8 satellite capsule 6.0, satellite 6.0 1:3.14.5.10-11.el7sat
  • foreman satellite 6.0 1.6.0.44-1.el6sat
  • foreman satellite 6.0 1.6.0.44-1.el7sat
  • katello satellite 6.0 1.5.0-30.el6sat
  • katello satellite 6.0 1.5.0-30.el7sat
  • mongodb satellite capsule 6.0, satellite 6.0 2.4.6-2.el6sat
  • mongodb satellite capsule 6.0, satellite 6.0 2.4.9-3.el7sat

red hat advisories RHEA-2014:1175RHSA-2014:0440RHSA-2014:0230

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-6619 updated cvss 5.8

mongodb: memory over-read via incorrect BSON object length

  • Red Hat OpenShift Enterprise 1 mongodb
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 3 mongodb Red Hat Subscription Asset Manager mongodb
    affected: no fix available
  • Red Hat Enterprise Linux OpenStack Platform 4.0 mongodb 2.2.4-4.el6ost, libmongodb 2.2.4-4.el6ost, mongodb-server 2.2.4-4.el6ost
    fixed: vendor fix RHSA-2014:0230
  • Red Hat MRG Grid Execute Node for RHEL 6 ComputeNode v.2 condor 7.8.10-0.1.el6, mrg-release 2.5.0-1.el6, condor-qmf 7.8.10-0.1.el6, condor-kbdd 7.8.10-0.1.el6, condor-vm-gahp 7.8.10-0.1.el6, condor-classads 7.8.10-0.1.el6 Red Hat MRG Grid Execute Node for RHEL 6 Server v.2 condor 7.8.10-0.1.el6, mrg-release 2.5.0-1.el6, condor-qmf 7.8.10-0.1.el6, condor-kbdd 7.8.10-0.1.el6, condor-vm-gahp 7.8.10-0.1.el6, condor-classads 7.8.10-0.1.el6 Red Hat MRG Grid for RHEL 6 Server v.2 mongodb 1.6.4-7.el6, cumin 0.1.5797-1.el6, condor 7.8.10-0.1.el6, mrg-release 2.5.0-1.el6, condor-qmf 7.8.10-0.1.el6, condor-kbdd 7.8.10-0.1.el6, +7 more Red Hat MRG Management for RHEL 6 ComputeNode v.2 mrg-release 2.5.0-1.el6 Red Hat MRG Management for RHEL 6 Server v.2 cumin 0.1.5797-1.el6, mrg-release 2.5.0-1.el6 Red Hat MRG Messaging for RHEL 6 Server v.2 mrg-release 2.5.0-1.el6
    +1 more products
    Red Hat MRG Realtime for RHEL 6 Server v.2 mrg-release 2.5.0-1.el6
    fixed: vendor fix RHSA-2014:0440
  • Red Hat Satellite 6.0 mongodb 2.4.6-2.el6sat, mongodb 2.4.9-3.el7sat, libmongodb 2.4.6-2.el6sat, mongodb-server 2.4.6-2.el6sat, mongodb-server 2.4.9-3.el7sat Red Hat Satellite Capsule 6.0 mongodb 2.4.6-2.el6sat, mongodb 2.4.9-3.el7sat, libmongodb 2.4.6-2.el6sat, mongodb-server 2.4.6-2.el6sat, mongodb-server 2.4.9-3.el7sat
    fixed: vendor fix RHEA-2014:1175
  • Red Hat OpenShift Enterprise 2 mongodb Red Hat Satellite 6.0 jansi 1.9-7.el7, bsf 2.4.0-19.el7, cglib 2.2-18.el7, guava 13.0-6.el7, xbean 3.13-6.el7, hawtjni 1.6-9.el7, +754 more Red Hat Satellite 6.0 - Optional ant-jmf 1.9.2-9.el7, ant-jsch 1.9.2-9.el7, ant-antlr 1.9.2-9.el7, ant-swing 1.9.2-9.el7, ant-manual 1.9.2-9.el7, ant-javadoc 1.9.2-9.el7, +21 more Red Hat Satellite Capsule 6.0 hiera 1.3.1-2.el7, hiera 1.0.0-3.el6_4, gofer 1.3.0-1.el6sat, gofer 1.3.0-1.el7sat, qpid-cpp 0.22-42.el6, qpid-cpp 0.22-42.el7, +214 more Red Hat Software Collections mongodb24-mongodb, mongodb24-libmongodb, mongodb24-mongodb-server
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.89% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • jira.mongodb.org https://jira.mongodb.org/browse/SERVER-7769 referenced PoC, tagged "exploit" by a source, unverified
  • blog.ptsecurity.com http://blog.ptsecurity.com/2012/11/attacking-mongodb.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P

Classification

Weakness
  • CWE-20 Improper Input Validation
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.