Denial of Service and Data Integrity vulnerability in features command
CVE-2021-32036

5.4MEDIUM

Key Information:

Vendor
MongoDB
Status
Mongodb Server
Vendor
CVE Published:
4 February 2022

Summary

An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28

Affected Version(s)

MongoDB Server 5.0 <= 5.0.3

MongoDB Server 4.4 <= 4.4.9

MongoDB Server 4.2 <= 4.2.16

References

https://jira.mongodb.org/browse/SERVER-59294
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.