CVE-2020-7928 — Improper Neutralization of Null Byte or NUL Character in INC Mongodb Server

CWE-158 — Improper Neutralization of Null Byte or NUL Character CWE-626 — Null Byte Interaction Error (Poison Null Byte)5 documents5 sources

Severity

6.5MEDIUMNVD

EPSS

0.5%

top 34.68%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mongodb INC Mongodb Server Mongodb

Timeline

PublishedNov 23

Latest updateMay 24

Description

A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects MongoDB Server v4.4 versions prior to 4.4.1; MongoDB Server v4.2 versions prior to 4.2.9; MongoDB Server v4.0 versions prior to 4.0.20 and MongoDB Server v3.6 versions prior to 3.6.20.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5mongodb_inc/mongodb_server4.4 — 4.4.1+3

▶NVDmongodb/mongodb3.6.0 — 3.6.20+4

Patches

Patch: jira.mongodb.org ↗Patch: jira.mongodb.org ↗

🔴Vulnerability Details

GHSA

GHSA-5mwc-rp6j-mw6r: A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries↗2022-05-24

▶

OSV

CVE-2020-7928: A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries↗2020-11-23

▶

CVEList

Improper neutralization of null byte leads to read overrun↗2020-11-23

▶

📋Vendor Advisories

Red Hat

mongodb: Read overrun and access of arbitrary memory in $arrayToObject↗2020-11-23

▶