CVE-2018-20805: Invariant with $elemMatch
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10.
Other sources
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.5; v3.6 versions prior to 3.6.10. This issue affects: MongoDB Inc. MongoDB Server 3.6 versions prior to 3.6.10; 4.0 versions prior to 4.0.5.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-20805?
CVE-2018-20805 is a vulnerability that allows a user with database query privileges to cause denial of service by executing specially crafted queries.
Which versions of MongoDB Server are affected by CVE-2018-20805?
MongoDB Server v4.0 versions prior to 4.0.5 and v3.6 versions prior to 3.6.10 are affected by CVE-2018-20805.
How can an attacker exploit CVE-2018-20805?
An attacker can exploit CVE-2018-20805 by issuing specially crafted queries that perform an $elemMatch operation.
What is the severity of CVE-2018-20805?
CVE-2018-20805 has a severity rating of medium with a CVSS score of 6.5.
Is there a fix available for CVE-2018-20805?
Yes, MongoDB Inc. released fixes for CVE-2018-20805 in MongoDB Server versions 4.0.5 and 3.6.10.