QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2021-32036

Back to search

CVE-2021-32036

Published: Feb 4, 2022

Modified: Nov 19, 2024

PUBLISHED

CVSS v3.1

5.4

MEDIUM

Description

An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28

VendorProductVersions

MongoDB Inc.

MongoDB Server

affected
5.0 - <= 5.0.3
affected
4.4 - <= 4.4.9
affected
4.2 - <= 4.2.16
affected
4.0 - <= 4.0.28

Weaknesses (CWE)

CWE-770

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now