STIGQter: STIG Summary: MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled.

DISA Rule

SV-265915r1028531_rule

Vulnerability Number

V-265915

Group Title

SRG-APP-000141-DB-000091

Rule Version

MD7X-00-003200

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.
• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.

Weight

10

Fix Recommendation

Disable the "javascriptEnabled" option.

Edit the MongoDB configuration file (default location: /etc/mongod.conf) to include the following:

security:
javascriptEnabled: false

Check Contents

MongoDB operations permit arbitrary JavaScript expressions to be run directly on the server.

If the following parameter is not present or not set as show below in the MongoDB configuration file (default location: /etc/mongod.conf), this is a finding.

security:
javascriptEnabled: false

Vulnerability Number

V-265915

Documentable

False

Rule Version

MD7X-00-003200

Severity Override Guidance

MongoDB operations permit arbitrary JavaScript expressions to be run directly on the server.

If the following parameter is not present or not set as show below in the MongoDB configuration file (default location: /etc/mongod.conf), this is a finding.

security:
javascriptEnabled: false

Check Content Reference

M

Target Key

5637