An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9.
Un atacante con permisos CRUD básicos en una colección replicada puede ejecutar el comando applyOps con entradas oplog especialmente malformadas, resultando en una potencial denegación de servicio en los secundarios. Este problema afecta a las versiones de MongoDB Server v4.0 anteriores a 4.0.25; a las versiones de MongoDB Server v4.2 anteriores a 4.2.14; a las versiones de MongoDB Server v4.4 anteriores a 4.4.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
AV:N/AC:L/Au:S/C:N/I:N/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | SINGLE |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-20
|
| [email protected] | Primary |
en
CWE-20
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| mongodb | mongodb | * | <built-in method update of dict object at 0x717bf8235a00> | Application |
| mongodb | mongodb | * | <built-in method update of dict object at 0x717bda9d9640> | Application |
| mongodb | mongodb | * | <built-in method update of dict object at 0x717bdabdeb40> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* |