- Security >
- Create a Vulnerability Report
Create a Vulnerability Report¶
On this page
If you believe you have discovered a vulnerability in MongoDB products or have experienced a security incident related to MongoDB products, please report the issue to aid in its resolution.
To report an issue, we strongly suggest filing a ticket in the SECURITY project in JIRA. MongoDB, Inc responds to vulnerability notifications within 48 hours.
Create the Report in JIRA¶
Submit a Ticket in the Security project on our JIRA. The ticket number will become the reference identification for the issue for its lifetime. You can use this identifier for tracking purposes.
Information to Provide¶
All vulnerability reports should contain as much information as possible so MongoDB’s developers can move quickly to resolve the issue. In particular, please include the following:
- The name of the product.
- Common Vulnerability information, if applicable, including:
- CVSS (Common Vulnerability Scoring System) Score.
- CVE (Common Vulnerability and Exposures) Identifier.
- Contact information, including an email address and/or phone number, if applicable.
Send the Report via Email¶
While JIRA is the preferred reporting method, you may also report vulnerabilities via email to security@mongodb.com.
You may encrypt email using MongoDB’s public key at https://docs.mongodb.com/10gen-security-gpg-key.asc.
MongoDB, Inc. responds to vulnerability reports sent via email with a response email that contains a reference number for a JIRA ticket posted to the SECURITY project.
Evaluation of a Vulnerability Report¶
MongoDB, Inc. validates all submitted vulnerabilities and uses Jira to track all communications regarding a vulnerability, including requests for clarification or additional information. If needed, MongoDB representatives set up a conference call to exchange information regarding the vulnerability.
Disclosure¶
MongoDB, Inc. requests that you do not publicly disclose any information regarding the vulnerability or exploit the issue until it has had the opportunity to analyze the vulnerability, to respond to the notification, and to notify key users, customers, and partners.
The amount of time required to validate a reported vulnerability depends on the complexity and severity of the issue. MongoDB, Inc. takes all required vulnerabilities very seriously and will always ensure that there is a clear and open channel of communication with the reporter.
After validating an issue, MongoDB, Inc. coordinates public disclosure of the issue with the reporter in a mutually agreed timeframe and format. If required or requested, the reporter of a vulnerability will receive credit in the published security bulletin.