Description

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining locks. This issue affects MongoDB Server v4.0 versions prior to 4.0.5; MongoDB Server v3.6 versions prior to 3.6.10 and MongoDB Server v3.4 versions prior to 3.4.19.

Remediation

References

CVE-2018-20803

Related Vulnerabilities

WordPress Plugin WTI Like Post SQL Injection (1.4.2)

MODX Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2017-7321)

WordPress Plugin Notification-Custom Notifications and Alerts for WordPress Cross-Site Scripting (7.2.4)

Apache Traffic Server Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2019-9516)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-3715)

Severity

Medium

Classification

CVE-2018-20803 CWE-835 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities