6.5

CVE-2020-7928

Improper neutralization of null byte leads to read overrun

A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects MongoDB Server v4.4 versions prior to 4.4.1; MongoDB Server v4.2 versions prior to 4.2.9; MongoDB Server v4.0 versions prior to 4.0.20 and MongoDB Server v3.6 versions prior to 3.6.20.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mongodb ≫ Mongodb Version >= 3.6.0 < 3.6.20
Mongodb ≫ Mongodb Version >= 4.0.0 < 4.0.20
Mongodb ≫ Mongodb Version >= 4.2.0 < 4.2.9
Mongodb ≫ Mongodb Version >= 4.4.0 < 4.4.1
Mongodb ≫ Mongodb Version >= 4.5.0 < 4.5.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.48% 0.645
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
cna@mongodb.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-158 Improper Neutralization of Null Byte or NUL Character

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

https://jira.mongodb.org/browse/SERVER-49404
Patch
Vendor Advisory
Issue Tracking