PT-2020-19850 · Mongodb · Mongodb Server+1

Published 2020-11-23 · Updated 2024-09-17 · CVE-2020-7925

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 4.4.0-rc12 MongoDB Server versions prior to 4.2.9

Description The issue is caused by incorrect validation of user input in the role name parser, which may lead to the use of uninitialized memory. This allows an unauthenticated attacker to use a specially crafted request to cause a denial of service.

Recommendations For MongoDB Server versions prior to 4.4.0-rc12, update to version 4.4.0-rc12 or later. For MongoDB Server versions prior to 4.2.9, update to version 4.2.9 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-475

CWE-20

Related Identifiers

BIT-MONGODB-2020-7925

CVE-2020-7925

Affected Products

Mongodb Server

Mongodb

References · 11

• https://jira.mongodb.org/browse/SERVER-49142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7925 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7925 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mongodb-2020-7925 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7925 · Security Note
• https://ubuntu.com/security/CVE-2020-7925 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7925 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7925 · Note
• https://t.me/cvenotify/6489 · Telegram Post
• https://t.me/cvenotify/94846 · Telegram Post
• https://t.me/cibsecurity/16703 · Telegram Post