Description

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3.

Remediation

References

CVE-2018-20802

Related Vulnerabilities

Magento Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2021-21016)

WordPress Plugin Integration for Contact Form 7 HubSpot Cross-Site Scripting (1.1.9)

Apache Traffic Server CVE-2014-3525 Vulnerability (CVE-2014-3525)

Oracle Database Server CVE-2006-0258 Vulnerability (CVE-2006-0258)

PostgreSQL Resource Management Errors Vulnerability (CVE-2009-0922)

Severity

Medium

Classification

CVE-2018-20802 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities