CVE-2020-7925
published 2020-11-23CVE-2020-7925: Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.66%
73.7th percentile
Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | — | — |
| mongodb | mongodb | >= 4.2.0 < 4.2.9 | 4.2.9 |
| mongodb_inc | mongodb_server | >= 4.2 < 4.2.9 | 4.2.9 |
| mongodb_inc | mongodb_server | >= 4.4 < 4.4.0-rc12 | 4.4.0-rc12 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mongodb: Incorrect validation of user input in the role name parser
vendor_redhat·2020-11-23·CVSS 7.5
CVE-2020-7925 [HIGH] CWE-20 mongodb: Incorrect validation of user input in the role name parser
mongodb: Incorrect validation of user input in the role name parser
Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9.
Package: mongodb (Red Hat Advanced Cluster Management for Kubernetes 2) - Not affected
Package: mongodb (Red Hat OpenStack Platform 10 (Newton)) - Out of support scope
Package: rh-mongodb36-mongodb (Red Hat Software Collections) - Not affected
Package: mongodb (Red Hat Update Infrastructure 3 for Cloud Providers) - Not affected
GHSA
GHSA-v8v4-4v92-48h2: Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a speci
ghsa_unreviewed·2022-05-24
CVE-2020-7925 [HIGH] CWE-20 GHSA-v8v4-4v92-48h2: Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a speci
Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc12; v4.2 versions prior to 4.2.9.
OSV
CVE-2020-7925: Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a speci
osv·2020-11-23·CVSS 7.5
CVE-2020-7925 [HIGH] CVE-2020-7925: Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a speci
Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-11-23
Published