PT-2022-16577 · Mongodb · Mongodb Server+1

Sara Golemon + 1 · Published 2022-04-21 · Updated 2024-03-06 · CVE-2022-24272

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to and including v5.0.6

Description An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mongod denial of service or server crash.

Recommendations For versions prior to and including v5.0.6, update to a version later than v5.0.6 to resolve the issue. As a temporary workaround, consider restricting access to the $external database to minimize the risk of exploitation.

Fix

DoS

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BIT-MONGODB-2022-24272

CVE-2022-24272

Affected Products

Mongodb Server

Mongodb

References · 11

• https://ubuntu.com/security/CVE-2022-24272 · Vendor Advisory
• https://jira.mongodb.org/browse/SERVER-63968 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24272 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24272 · Security Note
• https://osv.dev/vulnerability/BIT-mongodb-2022-24272 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24272 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24272 · Vendor Advisory
• https://t.me/cibsecurity/41219 · Telegram Post
• https://t.me/cvenotify/30058 · Telegram Post
• https://t.me/cvenotify/29275 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24272 · Note