IM
IronMonkey Threat Research

CVE-2020-7928 MEDIUM

Published: 2020-11-23 | Last Modified: 2024-11-21 | Status: Modified

Description

A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects MongoDB Server v4.4 versions prior to 4.4.1; MongoDB Server v4.2 versions prior to 4.2.9; MongoDB Server v4.0 versions prior to 4.0.20 and MongoDB Server v3.6 versions prior to 3.6.20.

Additional Descriptions (1)

Un usuario autorizado para realizar consultas de la base de datos puede desencadenar un desbordamiento de lectura y acceder a la memoria arbitraria mediante la emisión de consultas especialmente diseñadas. Este problema afecta a: MongoDB Server de MongoDB Inc versiones v4.4 anteriores a 4.4.1; versiones v4.2 anteriores a 4.2.9; versiones v4.0 anteriores a 4.0.20; versiones v3.6 anteriores a 3.6.20

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Base Score: 4.0 (MEDIUM)

AV:N/AC:L/Au:S/C:P/I:N/A:N

Access VectorNETWORK
Access ComplexityLOW
AuthenticationSINGLE
Confidentiality ImpactPARTIAL
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 8.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-158
[email protected] Primary
en NVD-CWE-Other

Affected Products

Vendor Product Version Update Type
mongodb mongodb * <built-in method update of dict object at 0x717bd424d880> Application
mongodb mongodb * <built-in method update of dict object at 0x717bd424c200> Application
mongodb mongodb * <built-in method update of dict object at 0x717bd424d1c0> Application
mongodb mongodb * <built-in method update of dict object at 0x717bdb7c38c0> Application
mongodb mongodb * <built-in method update of dict object at 0x717bdb7c25c0> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*

References

Notification
Message here