PT-2019-5513 · Mongodb+1 · Mongodb Server+2

Tony Yesudas · Published 2019-01-27 · Updated 2026-02-23 · CVE-2020-7921

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MongoDB Server versions 3.6.0 through 3.6.17 MongoDB Server versions 4.0.0 through 4.0.14 MongoDB Server versions 4.2.0 through 4.2.2 MongoDB Server versions 4.3.0 through 4.3.2

Description The issue is related to improper serialization of internal state in the authorization subsystem, allowing a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action.

Recommendations For MongoDB Server versions 3.6.0 through 3.6.17, update to version 3.6.18 or later. For MongoDB Server versions 4.0.0 through 4.0.14, update to version 4.0.15 or later. For MongoDB Server versions 4.2.0 through 4.2.2, update to version 4.2.3 or later. For MongoDB Server versions 4.3.0 through 4.3.2, update to version 4.3.3 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-182

CWE-863

Related Identifiers

ALT-PU-2022-3039

BDU:2020-03363

BIT-MONGODB-2020-7921

CVE-2020-7921

Affected Products

Alt Linux

Mongodb Server

Mongodb

References · 13

• https://jira.mongodb.org/browse/SERVER-45472 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mongodb-2020-7921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7921 · Security Note
• https://ubuntu.com/security/CVE-2020-7921 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7921 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7921 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7921 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03363 · Security Note
• https://t.me/cveNotify/152933 · Telegram Post
• https://t.me/sysadm_in_channel/1824 · Telegram Post
• https://t.me/cvenotify/3582 · Telegram Post
• https://t.me/cvenotify/68345 · Telegram Post
• https://securitylab.ru/vulnerability/508267.php · Note