CVE-2019-20925: mongodb inc mongodb server
Vulnerability summary
CVE-2019-20925 is a high (CVSS 7.5) vulnerability in mongodb inc mongodb server. EPSS estimates a 1.68% chance of exploitation in the next 30 days, higher than 76.5% of scored vulnerabilities.
Timeline
- 24-11-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.68%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
0.00 pp
From 1.68% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-839Numeric Range Comparison Without Minimum CheckThe product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
- CWE-697Incorrect ComparisonThe product compares two entities in a security-relevant context, but the comparison is incorrect.
Affected systems
Mongodb1 product
- mongodb≥ 3.4.0, < 3.4.24 | ≥ 3.6.0, < 3.6.15 | ≥ 4.0.0, < 4.0.13 | ≥ 4.2.0, < 4.2.1
Mongodb inc1 product
- mongodb server≥ 4.2, < 4.2.1 | ≥ 4.0, < 4.0.13 | ≥ 3.6, < 3.6.15 | ≥ 3.4, < 3.4.24
Ubuntu1 product
- mongodb< 1:3.6.3-0ubuntu1.4 | < 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3
3 vendors · 3 products