CVE-2020-7925: mongodb inc mongodb server Undefined Behavior for Input to API
Vulnerability summary
CVE-2020-7925 is a high (CVSS 7.5) Undefined Behavior for Input to API vulnerability in mongodb inc mongodb server. EPSS estimates a 1.69% chance of exploitation in the next 30 days, higher than 76.7% of scored vulnerabilities.
Timeline
- 23-11-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.69%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
+0.01 pp
From 1.68% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-475Undefined Behavior for Input to APIThe behavior of this function is undefined unless its control parameter is set to a specific value.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Mongodb1 product
- mongodbEOL≥ 4.2.0, < 4.2.9 | 4.4.0:rc1 | 4.4.0:rc10 | 4.4.0:rc11 | 4.4.0:rc2 | 4.4.0:rc3 | 4.4.0:rc4 | 4.4.0:rc5 | 4.4.0:rc6 | 4.4.0:rc7 | 4.4.0:rc8 | 4.4.0:rc9
Mongodb inc1 product
- mongodb server≥ 4.2, < 4.2.9 | ≥ 4.4, < 4.4.0-rc12
Ubuntu1 product
- mongodbAll versions (No fix recorded)
3 vendors · 3 products