CVE-2020-7925: Denial of Service when processing malformed Role names
First published: Mon Nov 23 2020(Updated: )
Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9.
Credit: cna@mongodb.com cna@mongodb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MongoDB MongoDB | >=4.2.0<4.2.9 | |
| MongoDB MongoDB | =4.4.0-rc1 | |
| MongoDB MongoDB | =4.4.0-rc10 | |
| MongoDB MongoDB | =4.4.0-rc11 | |
| MongoDB MongoDB | =4.4.0-rc2 | |
| MongoDB MongoDB | =4.4.0-rc3 | |
| MongoDB MongoDB | =4.4.0-rc4 | |
| MongoDB MongoDB | =4.4.0-rc5 | |
| MongoDB MongoDB | =4.4.0-rc6 | |
| MongoDB MongoDB | =4.4.0-rc7 | |
| MongoDB MongoDB | =4.4.0-rc8 | |
| MongoDB MongoDB | =4.4.0-rc9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
CVE-2020-7925
What is the severity of CVE-2020-7925?
The severity of CVE-2020-7925 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2020-7925?
MongoDB Server v4.4 versions prior to 4.4.0-rc12 and v4.2 versions between 4.2.0 and 4.2.9 are affected by CVE-2020-7925.
How can an unauthenticated attacker exploit CVE-2020-7925?
An unauthenticated attacker can exploit CVE-2020-7925 by using a specially crafted request to cause a denial of service.
Is there a fix available for CVE-2020-7925?
Yes, a fix is available for CVE-2020-7925. MongoDB Server v4.4.0-rc12 and v4.2.9 include the necessary patches to address this vulnerability.
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/severity
- agent/softwarecombine
- agent/description
- agent/event
- agent/last-modified-date
- agent/tags
- agent/author
- collector/nvd-index
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- vendor/mongodb
- canonical/mongodb mongodb
- version/mongodb mongodb/4.2.0
- version/mongodb mongodb/4.4.0-rc1
- version/mongodb mongodb/4.4.0-rc10
- version/mongodb mongodb/4.4.0-rc11
- version/mongodb mongodb/4.4.0-rc2
- version/mongodb mongodb/4.4.0-rc3
- version/mongodb mongodb/4.4.0-rc4
- version/mongodb mongodb/4.4.0-rc5
- version/mongodb mongodb/4.4.0-rc6
- version/mongodb mongodb/4.4.0-rc7
- version/mongodb mongodb/4.4.0-rc8
- version/mongodb mongodb/4.4.0-rc9