CVE-2020-7925CWE-475

Denial of Service when processing malformed Role names

High · published November 23, 2020

CVSS v3.1
7.5
EPSS
2%
Percentile
76.9
In the wild
Unconfirmed
What it is

Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01694 · 76.9th percentile
Weakness
CWE-475 · Undefined Behavior for Input to API
Published
2020-11-23T14:50Z
EPSS history
Timeline
  • 23 NOV 14:50Z
    Denial of Service when processing malformed Role names
    cvelistv5