← Back

CVE-2020-7928

nvd nist
Published: Nov 23, 2020Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects MongoDB Server v4.4 versions prior to 4.4.1; MongoDB Server v4.2 versions prior to 4.2.9; MongoDB Server v4.0 versions prior to 4.0.20 and MongoDB Server v3.6 versions prior to 3.6.20.

Affected (5)

Products: Mongodb: Mongodb
Mongodb
1 product
Mongodb
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Mongodb
Mongodb
From 3.6.0 to 3.6.20
Mongodb
From 4.0.0 to 4.0.20
Mongodb
From 4.2.0 to 4.2.9
Mongodb
From 4.4.0 to 4.4.1
Mongodb
From 4.5.0 to 4.5.1

Related CWEs

CWE-158
Improper Neutralization of Null Byte or NUL Character
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

References (2)

Source: cna@mongodb.com
Issue TrackingPatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatchVendor Advisory

Timeline

No history available yet.