Lucene search

[email protected]NVD:CVE-2020-7925

HistoryNov 23, 2020 - 3:15 p.m.

CVE-2020-7925

2020-11-2315:15:11

CWE-20

CWE-475

[email protected]

web.nvd.nist.gov

cve-2020-7925

mongodb server

uninitialized memory

unauthenticated attacker

denial of service

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

47.8%

JSON

Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9.

Affected configurations

Nvd

Node

mongodbmongodbRange4.2.0–4.2.9

mongodbmongodbMatch4.4.0rc1

mongodbmongodbMatch4.4.0rc10

mongodbmongodbMatch4.4.0rc11

mongodbmongodbMatch4.4.0rc2

mongodbmongodbMatch4.4.0rc3

mongodbmongodbMatch4.4.0rc4

mongodbmongodbMatch4.4.0rc5

mongodbmongodbMatch4.4.0rc6

mongodbmongodbMatch4.4.0rc7

mongodbmongodbMatch4.4.0rc8

mongodbmongodbMatch4.4.0rc9

VendorProductVersionCPE
mongodbmongodb*cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
mongodbmongodb4.4.0cpe:2.3:a:mongodb:mongodb:4.4.0:rc1:*:*:*:*:*:*
mongodbmongodb4.4.0cpe:2.3:a:mongodb:mongodb:4.4.0:rc10:*:*:*:*:*:*
mongodbmongodb4.4.0cpe:2.3:a:mongodb:mongodb:4.4.0:rc11:*:*:*:*:*:*
mongodbmongodb4.4.0cpe:2.3:a:mongodb:mongodb:4.4.0:rc2:*:*:*:*:*:*
mongodbmongodb4.4.0cpe:2.3:a:mongodb:mongodb:4.4.0:rc3:*:*:*:*:*:*
mongodbmongodb4.4.0cpe:2.3:a:mongodb:mongodb:4.4.0:rc4:*:*:*:*:*:*
mongodbmongodb4.4.0cpe:2.3:a:mongodb:mongodb:4.4.0:rc5:*:*:*:*:*:*
mongodbmongodb4.4.0cpe:2.3:a:mongodb:mongodb:4.4.0:rc6:*:*:*:*:*:*
mongodbmongodb4.4.0cpe:2.3:a:mongodb:mongodb:4.4.0:rc7:*:*:*:*:*:*

Vendor	Product	Version	CPE
mongodb	mongodb	*	cpe:2.3:a:mongodb:mongodb::::::::
mongodb	mongodb	4.4.0	cpe:2.3:a:mongodb:mongodb:4.4.0:rc1::::::
mongodb	mongodb	4.4.0	cpe:2.3:a:mongodb:mongodb:4.4.0:rc10::::::
mongodb	mongodb	4.4.0	cpe:2.3:a:mongodb:mongodb:4.4.0:rc11::::::
mongodb	mongodb	4.4.0	cpe:2.3:a:mongodb:mongodb:4.4.0:rc2::::::
mongodb	mongodb	4.4.0	cpe:2.3:a:mongodb:mongodb:4.4.0:rc3::::::
mongodb	mongodb	4.4.0	cpe:2.3:a:mongodb:mongodb:4.4.0:rc4::::::
mongodb	mongodb	4.4.0	cpe:2.3:a:mongodb:mongodb:4.4.0:rc5::::::
mongodb	mongodb	4.4.0	cpe:2.3:a:mongodb:mongodb:4.4.0:rc6::::::
mongodb	mongodb	4.4.0	cpe:2.3:a:mongodb:mongodb:4.4.0:rc7::::::