IM
IronMonkey Threat Research

CVE-2020-7921 MEDIUM

Published: 2020-05-06 | Last Modified: 2026-02-23 | Status: Modified

Description

Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action. This issue affects MongoDB Server v4.2 versions prior to 4.2.3; MongoDB Server v4.0 versions prior to 4.0.15; MongoDB Server v4.3 versions prior to 4.3.3and MongoDB Server v3.6 versions prior to 3.6.18.

Additional Descriptions (1)

Una serialización inapropiada del estado interno en el subsistema de autorización en el subsistema de autorización en MongoDB Server, permite a un usuario con credenciales no válidas omitir los mecanismos de protección de lista blanca de IP después de una acción administrativa. Este problema afecta a: MongoDB Inc. MongoDB Server versiones 4.2 anteriores a 4.2.3; versiones 4.0 anteriores a 4.0.15; versiones 4.3 anteriores a 4.3.3; versiones 3.6 anteriores a 3.6.18.

CVSS Metrics

Base Score: 5.3 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactHIGH
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 1.6

Impact Score: 3.6

Base Score: 3.5 (LOW)

AV:N/AC:M/Au:S/C:N/I:P/A:N

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationSINGLE
Confidentiality ImpactNONE
Integrity ImpactPARTIAL
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 6.8

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-182
[email protected] Primary
en CWE-863

Affected Products

Vendor Product Version Update Type
mongodb mongodb * <built-in method update of dict object at 0x717bd4e19cc0> Application
mongodb mongodb * <built-in method update of dict object at 0x717bd4e1b980> Application
mongodb mongodb * <built-in method update of dict object at 0x717bdaeb13c0> Application
mongodb mongodb * <built-in method update of dict object at 0x717bdaeb0400> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*

References

Notification
Message here