CVE-2021-32036CWE-770

Denial of Service and Data Integrity vulnerability in features command

Medium · published February 4, 2022

CVSS v3.1
5.4
EPSS
1%
Percentile
63.8
In the wild
Unconfirmed
What it is

An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01043 · 63.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2022-02-04T22:33Z
EPSS history
Timeline
  • 04 FEB 22:33Z
    Denial of Service and Data Integrity vulnerability in features command
    cvelistv5