CVE-2019-20923
published 2020-11-23CVE-2019-20923: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions…
PriorityP433medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
1.25%
65.8th percentile
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0 versions prior to 4.0.7.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | >= 4.0.0 < 4.0.7 | 4.0.7 |
| mongodb_inc | mongodb_server | >= 4.0 < 4.0.7 | 4.0.7 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
osv6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mongodb: Denial of service via unhandled Javascript exceptions
vendor_redhat·2020-11-23·CVSS 6.5
CVE-2019-20923 [MEDIUM] CWE-749 mongodb: Denial of service via unhandled Javascript exceptions
mongodb: Denial of service via unhandled Javascript exceptions
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0 versions prior to 4.0.7.
Package: mongodb (Red Hat Advanced Cluster Management for Kubernetes 2) - Not affected
Package: mongodb (Red Hat OpenStack Platform 10 (Newton)) - Out of support scope
Package: rh-mongodb36-mongodb (Red Hat Software Collections) - Not affected
Package: mongodb (Red Hat Update Infrastructure 3 for Cloud Providers) - Not affected
GHSA
GHSA-f4mh-7qwc-2533: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exc
ghsa_unreviewed·2022-05-24
CVE-2019-20923 [MEDIUM] CWE-749 GHSA-f4mh-7qwc-2533: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exc
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.7.
OSV
CVE-2019-20923: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exc
osv·2020-11-23·CVSS 6.5
CVE-2019-20923 [MEDIUM] CVE-2019-20923: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exc
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0 versions prior to 4.0.7.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-11-23
Published