CVE-2019-20924 — Unexpected Status Code or Return Value in INC Mongodb Server

CWE-394 — Unexpected Status Code or Return Value CWE-754 — Improper Check for Unusual or Exceptional Conditions CWE-393 — Return of Wrong Status Code5 documents5 sources

Severity

6.5MEDIUMNVD

EPSS

0.4%

top 37.68%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mongodb INC Mongodb Server Mongodb

Timeline

PublishedNov 23

Latest updateMay 24

Description

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsBuilder. This issue affects MongoDB Server v4.2 versions prior to 4.2.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5mongodb_inc/mongodb_server4.2 — 4.2.2

▶NVDmongodb/mongodb4.2.0 — 4.2.2

🔴Vulnerability Details

GHSA

GHSA-6xgv-xq79-gp8c: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the Ind↗2022-05-24

▶

OSV

CVE-2019-20924: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the Ind↗2020-11-23

▶

CVEList

Invariant in IndexBoundsBuilder↗2020-11-23

▶

📋Vendor Advisories

Red Hat

mongodb: Denial of service via crafted queries which trigger an invariant in the IndexBoundsBuilder↗2020-11-23

▶