6.5med
CVE-2018-20802
Post-auth queries on compound index may crash mongod
Published 5 y ago · modified 4 mo ago · JSON
CVSS
6.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
0
none known
Summary
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3.
Exploit prediction (EPSS)
1.58% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:N/A:P |
Affected products
- MongoDB Inc. MongoDB Server
Classification
- Weakness
- CWE-394 Unexpected Status Code or Return Value
- Technology feeds
- MongoDB (RSS, critical only)
References
- jira.mongodb.org /browse/SERVER-36993 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-20802
- NVD: CVE-2018-20802
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.