Lucene search

[email protected]CVE-2021-32036

HistoryFeb 04, 2022 - 11:15 p.m.

CVE-2021-32036

2022-02-0423:15:11

CWE-770

[email protected]

web.nvd.nist.gov

cve-2021-32036

authenticated user

denial of service

resource depletion

high lock contention

id field collisions

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

6.6 Medium

AI Score

Confidence

High

5.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

0.001 Low

EPSS

Percentile

29.8%

JSON

An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28

Affected configurations

NVD

Node

mongodbmongodbRange2.0.0–4.2.18

mongodbmongodbRange4.4.0–4.4.10

mongodbmongodbRange5.0.0–5.0.4

CPENameOperatorVersion
mongodb:mongodbmongodblt4.2.18
mongodb:mongodbmongodblt4.4.10
mongodb:mongodbmongodblt5.0.4

CPE	Name	Operator	Version
mongodb:mongodb	mongodb	lt	4.2.18
mongodb:mongodb	mongodb	lt	4.4.10
mongodb:mongodb	mongodb	lt	5.0.4

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MongoDB Server",
    "vendor": "MongoDB Inc.",
    "versions": [
      {
        "lessThanOrEqual": "5.0.3",
        "status": "affected",
        "version": "5.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.4.9",
        "status": "affected",
        "version": "4.4",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.16",
        "status": "affected",
        "version": "4.2",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.0.28",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      }
    ]
  }
]