CVE-2018-25004: Invariant failure when explaining a find with a UUID
A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11.
Other sources
A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.6; MongoDB Server v3.6 versions prior to 3.6.11.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-25004?
CVE-2018-25004 is a vulnerability that allows a user authorized to performing a specific type of query in MongoDB Server versions prior to 4.0.6 and 3.6.11 to trigger a denial of service by issuing a generic explain command on a find query.
Which versions of MongoDB Server are affected by CVE-2018-25004?
CVE-2018-25004 affects MongoDB Server v4.0 versions prior to 4.0.6 and v3.6 versions prior to 3.6.11.
What is the severity of CVE-2018-25004?
CVE-2018-25004 has a severity rating of 4.9, which is considered medium.
How can CVE-2018-25004 be exploited?
CVE-2018-25004 can be exploited by a user authorized to perform a specific type of query in MongoDB Server by issuing a generic explain command on a find query.
Is there a fix or patch available for CVE-2018-25004?
Yes, MongoDB Inc. has released patches for CVE-2018-25004. Users should update to MongoDB Server v4.0.6 or v3.6.11 to fix the vulnerability.