CVE-2018-20802

EUVD-2018-13344 · Published Nov 23, 2020

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3.

Technologies

Mongodb Mongodb

Weaknesses

CWE-394NVD-CWE-Other

CVSS scores

v3.16.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
v2.04.0AV:N/AC:L/Au:S/C:N/I:N/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://jira.mongodb.org/browse/SERVER-36993

Potentially impacted assets

See if this affects your attack surface