STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Unused database components, MongoDB software, and database objects must be removed.

DISA Rule

SV-279344r1179199_rule

Vulnerability Number

V-279344

Group Title

SRG-APP-000141-DB-000091

Rule Version

MD8X-00-003000

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Disable the "javascriptEnabled" option.

Edit the MongoDB configuration file (default location: /etc/mongod.conf) to include the following:

security:
javascriptEnabled: false

Check Contents

MongoDB operations permit arbitrary JavaScript expressions to be run directly on the server.

If the following parameter is not present or not set as show below in the MongoDB configuration file (default location: /etc/mongod.conf), this is a finding.

security:
javascriptEnabled: false

Vulnerability Number

V-279344

Documentable

False

Rule Version

MD8X-00-003000

Severity Override Guidance

MongoDB operations permit arbitrary JavaScript expressions to be run directly on the server.

If the following parameter is not present or not set as show below in the MongoDB configuration file (default location: /etc/mongod.conf), this is a finding.

security:
javascriptEnabled: false

Check Content Reference

M

Target Key

5728