What is the CVSS score of CVE-2025-6711?

CVE-2025-6711 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of MongoDB are affected by CVE-2025-6711?

CVE-2025-6711 presents moderate security risk, a log file exposure vulnerability rated CVSS 4.4. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2025-6711?

Within 30 days: Identify affected systems running MongoDB Server where unredacted queries may inadvertently ap and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

MongoDB CVE-2025-6711

EUVD-2025-20248 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2025-07-07 cna@mongodb.com

Information Disclosure MongoDB Debian Ubuntu

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 03:37 euvd

EUVD-2025-20248

Analysis Generated

Mar 16, 2026 - 03:37 vuln.today

CVE Published

Jul 07, 2025 - 15:15 nvd

MEDIUM 4.4

DescriptionCVE.org

An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0 versions prior to 8.0.5, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v6.0 versions prior to 6.0.21.

Analysis

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Insertion of Sensitive Information into Log File (CWE-532).

RemediationAI

Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.

More in MongoDB

View all

CVE-2013-1892 MEDIUM This Month POC

6.0 Oct 01

MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo

CVE-2013-3969 MEDIUM This Month POC

6.5 Oct 01

The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a

CVE-2018-13863 HIGH This Week POC

7.5 Jul 10

The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul

CVE-2026-25887 HIGH This Week POC

7.2 Mar 06

Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut

CVE-2019-2386 HIGH This Week POC

7.1 Aug 06

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's

CVE-2012-6619 MEDIUM This Month POC

6.4 Mar 06

The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to

CVE-2026-3431 CRITICAL Act Now

9.8 Mar 02

SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary

CVE-2024-8654 CRITICAL Act Now

9.8 Sep 10

MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle

CVE-2024-6376 CRITICAL Act Now

9.8 Jul 01

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e

CVE-2024-1351 CRITICAL Act Now

9.8 Mar 07

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma

CVE-2020-7610 CRITICAL Act Now

9.8 Mar 30

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8

CVE-2026-19001 CRITICAL Act Now

9.5 Aug 12

Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or

Same weakness CWE-532 – Insertion of Sensitive Information into Log File

View all

CVE-2023-43261 HIGH POC

7.5

CVE-2025-24984 MEDIUM

4.6

CVE-2017-8075 CRITICAL POC

9.8

CVE-2017-8074 CRITICAL POC

9.8

CVE-2026-22778 CRITICAL POC

9.8

CVE-2019-17395 CRITICAL POC

9.8

CVE-2019-17398 CRITICAL POC

9.8

CVE-2019-17394 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

Ubuntu

Priority: Medium

mongodb

Release	Status	Version
jammy	DNE	-
noble	DNE	-
bionic	deferred	2026-02-18
trusty	deferred	2026-02-18
xenial	deferred	2026-02-18
oracular	DNE	-
plucky	DNE	-
upstream	released	6.0.21, 7.0.18, 8.0.5
questing	DNE	-
focal	deferred	2026-02-18

Debian

mongodb

Release	Status	Fixed Version	Urgency
(unstable)	fixed	(unfixed)	-

CVE-2025-6711 vulnerability details – vuln.today

Back

MongoDB CVE-2025-6711

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in MongoDB

Same weakness CWE-532 – Insertion of Sensitive Information into Log File

Same technique Information Disclosure

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code