CVE-2025-11535 - Vulnerability Details - OpenCVE

MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Microsoft	Windows
Mongodb	Connector For Bi Mongodb

No data.

No data.

References

Link	Providers
https://www.mongodb.com/docs/bi-connector/current/release-notes/#bi-2.14.25

History

Thu, 09 Oct 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 09 Oct 2025 13:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microsoft Microsoft windows Mongodb Mongodb connector For Bi Mongodb mongodb
Vendors & Products		Microsoft Microsoft windows Mongodb Mongodb connector For Bi Mongodb mongodb

Wed, 08 Oct 2025 22:15:00 +0000

Type	Values Removed	Values Added
Description		MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24.
Title		MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories
Weaknesses		CWE-276
References		https://www.mongodb.com/docs/bi-connector/current/release-notes/#bi-2.14.25
Metrics		cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`

MITRE

Status: PUBLISHED

Assigner: mongodb

Published: 2025-10-08T22:07:18.498Z

Updated: 2025-10-10T03:55:24.212Z

Reserved: 2025-10-08T21:16:03.837Z

Link: CVE-2025-11535

Vulnrichment

Updated: 2025-10-09T14:32:33.626Z

NVD

Status : Awaiting Analysis

Published: 2025-10-08T22:15:32.557

Modified: 2025-10-09T15:50:04.013

Link: CVE-2025-11535

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-11535", "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "state": "PUBLISHED", "assignerShortName": "mongodb", "dateReserved": "2025-10-08T21:16:03.837Z", "datePublished": "2025-10-08T22:07:18.498Z", "dateUpdated": "2025-10-10T03:55:24.212Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "MongoDB Connector for BI", "vendor": "MongoDB Inc", "versions": [{"lessThanOrEqual": "2.14.24", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}], "datePublic": "2025-10-08T21:26:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "MongoDB Connector for BI installation via <span style=\"background-color: rgb(255, 255, 255);\">MSI </span><span style=\"background-color: rgb(255, 255, 255);\">on Windows </span>leaves ACLs unset on custom install directories allows Privilege Escalation.<p>This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24.</p>"}], "value": "MongoDB Connector for BI installation via\u00a0MSI\u00a0on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 8.8, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "shortName": "mongodb", "dateUpdated": "2025-10-08T22:07:18.498Z"}, "references": [{"url": "https://www.mongodb.com/docs/bi-connector/current/release-notes/#bi-2.14.25"}], "source": {"discovery": "EXTERNAL"}, "title": "MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-09T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-11535"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-10T03:55:24.212Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11535", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-09T14:30:30.310942Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T14:32:33.626Z"}}], "cna": {"title": "MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MongoDB Inc", "product": "MongoDB Connector for BI", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "custom", "lessThanOrEqual": "2.14.24"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "datePublic": "2025-10-08T21:26:00.000Z", "references": [{"url": "https://www.mongodb.com/docs/bi-connector/current/release-notes/#bi-2.14.25"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "MongoDB Connector for BI installation via\u00a0MSI\u00a0on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24.", "supportingMedia": [{"type": "text/html", "value": "MongoDB Connector for BI installation via <span style=\"background-color: rgb(255, 255, 255);\">MSI </span><span style=\"background-color: rgb(255, 255, 255);\">on Windows </span>leaves ACLs unset on custom install directories allows Privilege Escalation.<p>This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions"}]}], "providerMetadata": {"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "shortName": "mongodb", "dateUpdated": "2025-10-08T22:07:18.498Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11535", "state": "PUBLISHED", "dateUpdated": "2025-10-10T03:55:24.212Z", "dateReserved": "2025-10-08T21:16:03.837Z", "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "datePublished": "2025-10-08T22:07:18.498Z", "assignerShortName": "mongodb"}, "dataVersion": "5.1"}