Bi Connector Transition Readiness Report
Monthly
Stored cross-site scripting in MongoDB's MongoSQL Transition Readiness Tool allows any authenticated BI Connector query issuer to inject arbitrary HTML markup into operator-generated reports by embedding script payloads in query strings that the BI Connector logs verbatim. When an operator later generates an HTML report from affected logs and opens it in a browser, the injected markup executes, potentially disclosing other users' logged query text and usernames to attacker-controlled infrastructure or presenting spoofed content to the operator. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; the required two-step operator interaction substantially limits opportunistic exploitation.
CSV injection in the MongoDB MongoSQL Transition Readiness Tool allows a low-privileged cluster user to embed spreadsheet formula directives inside database or collection names, which are written unsanitized into generated CSV reports. When an operator opens the report in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the formula executes on the operator's workstation, potentially exfiltrating report contents to an attacker-controlled endpoint or triggering external content retrieval. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is constrained by the requirement for both cluster write access and an operator who opens the file in a formula-evaluating spreadsheet.
Stored cross-site scripting in the MongoDB BI Connector Transition Readiness Report tool allows a low-privileged MongoDB user with write access to inject malicious script payloads into database metadata. When a second user generates and opens the resulting HTML report, the embedded scripts execute in their browser context, potentially exposing report contents or manipulating the displayed output. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the stored delivery model increases reachability beyond typical reflected-XSS scenarios.
Stored cross-site scripting in MongoDB's MongoSQL Transition Readiness Tool allows any authenticated BI Connector query issuer to inject arbitrary HTML markup into operator-generated reports by embedding script payloads in query strings that the BI Connector logs verbatim. When an operator later generates an HTML report from affected logs and opens it in a browser, the injected markup executes, potentially disclosing other users' logged query text and usernames to attacker-controlled infrastructure or presenting spoofed content to the operator. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; the required two-step operator interaction substantially limits opportunistic exploitation.
CSV injection in the MongoDB MongoSQL Transition Readiness Tool allows a low-privileged cluster user to embed spreadsheet formula directives inside database or collection names, which are written unsanitized into generated CSV reports. When an operator opens the report in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the formula executes on the operator's workstation, potentially exfiltrating report contents to an attacker-controlled endpoint or triggering external content retrieval. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is constrained by the requirement for both cluster write access and an operator who opens the file in a formula-evaluating spreadsheet.
Stored cross-site scripting in the MongoDB BI Connector Transition Readiness Report tool allows a low-privileged MongoDB user with write access to inject malicious script payloads into database metadata. When a second user generates and opens the resulting HTML report, the embedded scripts execute in their browser context, potentially exposing report contents or manipulating the displayed output. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the stored delivery model increases reachability beyond typical reflected-XSS scenarios.