« Volver al listado

CVE-2020-7925

Estado: ModificadaAlta (7.5)—

Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mongodb — Mongodb

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-7925",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@mongodb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@mongodb.com",
      "affectedData": [
        {
          "vendor": "MongoDB Inc.",
          "product": "MongoDB Server",
          "versions": [
            {
              "status": "affected",
              "version": "4.2",
              "lessThan": "4.2.9",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.4",
              "lessThan": "4.4.0-rc12",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2020-11-23T15:15:11.543",
  "references": [
    {
      "url": "https://jira.mongodb.org/browse/SERVER-49142",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cna@mongodb.com"
    },
    {
      "url": "https://jira.mongodb.org/browse/SERVER-49142",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@mongodb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-475"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9."
    },
    {
      "lang": "es",
      "value": "Una comprobación inapropiada de la entrada del usuario en el analizador de nombres de funciones puede conllevar al uso de memoria no inicializada, permitiendo a un atacante no autenticado usar una petición especialmente diseñada para causar una denegación de servicio. Este problema afecta a: MongoDB Server de MongoDB Inc versiones v4.4 anteriores a 4.4.0-rc12; versiones v4.2 anteriores a 4.2.9"
    }
  ],
  "lastModified": "2026-06-17T03:25:38.530",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5705F2A5-0F0D-4E46-A422-6C5BDAEC952F",
              "versionEndExcluding": "4.2.9",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:4.4.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF2A35D2-1B6C-4078-8BC1-80C82228B7B8"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:4.4.0:rc10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "489CEAC3-50D9-455C-9C09-E6777E673939"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:4.4.0:rc11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6A05675-76B6-413C-9091-D58A8C5FD132"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:4.4.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C22231F-287E-429D-B6C8-79D7663DA6BD"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:4.4.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8715F9E2-6853-4C39-86BB-930D86750627"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:4.4.0:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "189659E7-4120-433A-9B3E-D7F6DEA5E1E5"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:4.4.0:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "060EAC03-3F8E-419C-8E51-F1604676F50A"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:4.4.0:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D72DBC1F-53C5-45E5-A81F-5FD1E7160226"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:4.4.0:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1C6E555-F16F-45F3-9670-79B90BC663C8"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:4.4.0:rc8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7CE58B9-4D03-4699-BCEE-66AF65260D95"
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:4.4.0:rc9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0C6031C-0830-46D0-B27F-C754FDFABB29"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@mongodb.com"
}