CVE-2013-4650

NameCVE-2013-4650
DescriptionMongoDB 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allows remote authenticated users to obtain internal system privileges by leveraging a username of __system in an arbitrary database.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs715007

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mongodb (PTS)jessie1:2.4.10-5+deb8u1fixed
stretch (security), stretch (lts), stretch1:3.2.11-2+deb9u2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mongodbsourcesqueeze(not affected)
mongodbsourcewheezy(not affected)
mongodbsource(unstable)1:2.4.5-1715007

Notes

[squeeze] - mongodb <not-affected> (Only affects 2.4.x)
[wheezy] - mongodb <not-affected> (Only affects 2.4.x)

Search for package or bug name: Reporting problems