CVE-2021-20330
15.12.2021, 13:15
An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| mongodb | mongodb | 4.0.0 ≤ 𝑥 < 4.0.25 |
| mongodb | mongodb | 4.2.0 ≤ 𝑥 < 4.2.14 |
| mongodb | mongodb | 4.4.0 ≤ 𝑥 < 4.4.6 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| mongodb | mongodb | 4.0 ≤ 𝑥 < 4.0.27 | ADP |
| mongodb | mongodb | 4.2 ≤ 𝑥 < 4.2.18 | ADP |
| mongodb | mongodb | 4.4 ≤ 𝑥 < 4.4.9 | ADP |
Ubuntu Releases
Common Weakness Enumeration