Ubuntu.comUB:CVE-2021-32036CVE-2021-32036
5.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:P/A:P
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
6.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
29.8%
An authenticated user without any specific authorizations may be able to
repeatedly invoke the features command where at a high volume may lead to
resource depletion or generate high lock contention. This may result in
denial of service and in rare cases could result in id field collisions.
This issue affects MongoDB Server v5.0 versions prior to and including
5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB
Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0
versions prior to and including 4.0.28
Bugs
Notes
| Author | Note |
|---|---|
| sbeattie | the oidReset command implementation has existed in a couple of different locations in mongodb history, in src/mongo/db/commands/generic.cpp during 3.6.x and src/mongo/db/dbcommands_generic.cpp in 2.x timeframe. All of those implementations of oidReset lack an authorization requirement. all of the upstream commits for this issue are on branches licensed under mongodb’s SSPL, which makes backporting them to GNU Affero licensed versions problematic. |
Related
5.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:P/A:P
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
6.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
29.8%