Description

An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9.

Remediation

References

CVE-2021-20330

Related Vulnerabilities

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Cross-Site Scripting (1.7.2)

WordPress Plugin Migration, Backup, Staging-WPvivid SQL Injection (0.9.52)

WordPress Plugin Delete Duplicate Posts Security Bypass (4.1.9.4)

WordPress Plugin Easy Registration Forms Cross-Site Scripting (2.1.1)

Oracle Database Server CVE-2006-0258 Vulnerability (CVE-2006-0258)

Severity

Medium

Classification

CVE-2021-20330 CWE-20 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities