1. Cutsforth Support
  2. InsightCM™ Software
  3. InsightCM™ Support Articles

How to Patch MongoDB on InsightCM Due to the MongoBleed Vulnerability?

Follow

Issue Details

MongoBleed (CVE-2025-14847) is a vulnerability that allows an attacker to read uninitialized heap memory that was previously allocated from a database operation. For an overview of this vulnerability, visit:

https://bigdata.2minutestreaming.com/p/mongobleed-explained-simply

InsightCM uses MongoDB for storing configuration data. InsightCM's MongoDB setup only allows access from localhost (the server that InsightCM is installed on) so this vulnerability cannot be exploited from machines other than the InsightCM server. To completely fix the vulnerability, a patch to MongoDB can be applied.

This vulnerability applies to InsightCM versions 3.8.5 to 3.12.

If you have InsightCM 3.8.5 to 3.9.1, there is no available patch from MongoDB. To fix this vulnerability, you will need to upgrade to a newer version of InsightCM.

If you have InsightCM 3.9.2 to 3.12, there is a patch available. Follow the instruction below on how to apply the MongoDB patch.

Reported in

Software Version

Hardware

InsightCM 3.12.0+ uses MongoDB 7.0.21 (vulnerable)

InsightCM 3.10 – 3.11.1 uses MongoDB 7.0.11 (vulnerable)

InsightCM 3.9.2 – 3.9.3 uses MongoDB 6.0.8 (vulnerable)

Any

Solution / Procedure

Description

  1. As a best practice, create a backup or restore point of the server.

  2. Use the following table to download the correct MongoDB installer.

    InsightCM Version

    MongoDB Version Installed

    Download Version

    3.12.x

    MongoDB 7.0.21 (vulnerable)

    7.0.28

    3.11.x

    MongoDB 7.0.11 (vulnerable)

    7.0.28

    3.10.x

    MongoDB 7.0.11 (vulnerable)

    7.0.28

    3.9.2+

    MongoDB 6.0.8 (vulnerable)

    6.0.27

  3. MongoDB installer can be found at the following locations. If you do not see the version on the latest version page, go to the archived release page.

    1. Latest community releases - https://www.mongodb.com/try/download/community

    2. Archived community releases - https://www.mongodb.com/try/download/community-edition/releases/archive

  4. Stop the InsightCM services.

    1. InsightCM

    2. InsightCM MongoDB

    3. Postgresql-x64 Service (Stop all)

    4. RabbitMQ

  5. Run the MongoDB installer.

    1. Agree to the license

    2. Install the Custom option and de-select the Router and Miscellaneous Tools option.

      Custom_Setup.jpg

  6. Uncheck the option “Install MongoDB as a Service”.

    Server_Configuration.png

  7. In the installer dialog, click Next, Next, Install.

  8. Once it finishes installing it will open Mongo Compass if you use the Complete option.

  9. Start all the Services.

    1. RabbitMQ

    2. Postgresql-x64 Service

    3. InsightCM MongoDB

    4. InsightCM

Do you need more help?

Submit your questions or requests using the Support Ticket Submission form.

Was this article helpful?
0 out of 0 found this helpful

Articles in this section

See more