CVE-2018-20805 — Excessive Iteration in INC Mongodb Server

CWE-834 — Excessive IterationCWE-835 — Infinite Loop5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 37.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mongodb INC Mongodb ServerMongodb
Timeline
PublishedNov 23
Latest updateMay 24

Description

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5mongodb_inc/mongodb_server3.6 — 3.6.10+1
▶NVDmongodb/mongodb3.6.0 — 3.6.10+1

🔴Vulnerability Details

3
GHSA
GHSA-h55v-wgpx-c3rf: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch This iss↗2022-05-24
▶
OSV
CVE-2018-20805: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch↗2020-11-23
▶
CVEList
Invariant with $elemMatch↗2020-11-23
▶

📋Vendor Advisories

1
Red Hat
mongodb: Denial of service via crafted queries which perform an $elemMatch↗2020-11-23
▶
CVE-2018-20805 — Excessive Iteration | cvebase