CVE-2020-7921 Administrative action may disable enforcement of per-user IP whitelisting

🗓️ 06 May 2020 14:55:12Reported by mongodbType

CVE-2020-7921 MongoDB Server Authorization Bypas

Reporter	Title	Published	Views	Family All 34
IBM Security Bulletins	Security Bulletin: IBM Cloud Private is vulnerable to a MongoDB vulnerability (CVE-2020-7921)	27 Sep 202018:26	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in jQuery, Spring, Dom4j, MongoDB, Linux Kernel, Targetcli-fb, Jackson, Node.js, and Apache Commons affect IBM Spectrum Protect Plus	20 Nov 202020:41	–	ibm
BDU FSTEC	The vulnerability of the document-oriented database management system MongoDB, related to authentication errors, allows a perpetrator to gain unauthorized access to protected information.	17 Jul 202000:00	–	bdu_fstec
CNVD	MongoDB Server Security Mechanism Bypass Vulnerability	7 May 202000:00	–	cnvd
CVE	CVE-2020-7921	6 May 202014:55	–	cve
FreeBSD	MongoDB -- Ensure RoleGraph can serialize authentication restrictions to BSON	10 Jan 202000:00	–	freebsd
Debian CVE	CVE-2020-7921	6 May 202014:55	–	debiancve
Tenable Nessus	Dell Wyse Management Suite < 3.2 Multiple Vulnerabilities (DSA-2021-070)	7 Apr 202100:00	–	nessus
Tenable Nessus	FreeBSD : MongoDB -- Ensure RoleGraph can serialize authentication restrictions to BSON (d0be8e1f-b19a-11ea-94aa-b827eb2f57d4)	30 Jun 202000:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2020-7921	19 Aug 202500:00	–	nessus

[
  {
    "defaultStatus": "unaffected",
    "product": "MongoDB Server",
    "vendor": "MongoDB Inc.",
    "versions": [
      {
        "lessThan": "4.2.3",
        "status": "affected",
        "version": "4.2",
        "versionType": "custom"
      },
      {
        "lessThan": "4.0.15",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      },
      {
        "lessThan": "3.6.18",
        "status": "affected",
        "version": "3.6",
        "versionType": "custom"
      },
      {
        "lessThan": "4.3.3",
        "status": "affected",
        "version": "4.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
jira	www.jira.mongodb.org/browse/SERVER-45472

23 Jan 2024 15:07Current

5.1Medium risk

Vulners AI Score5.1

CVSS 3.14.6

EPSS0.0066

CWE-182