Vulnerabilities > CVE-2018-20803 - Infinite Loop vulnerability in Mongodb

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

mongodb

CWE-835

NVD

Published: 2020-11-23

Updated: 2024-09-16

Summary

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining locks. This issue affects MongoDB Server v4.0 versions prior to 4.0.5; MongoDB Server v3.6 versions prior to 3.6.10 and MongoDB Server v3.4 versions prior to 3.4.19.

Vulnerable Configurations

Part	Description	Count
Application	Mongodb Mongodb Mongodb 3.4.0 Mongodb Mongodb 3.4.1 Mongodb Mongodb 3.4.2 Mongodb Mongodb 3.4.3 Mongodb Mongodb 3.4.4 Mongodb Mongodb 3.4.5 Mongodb Mongodb 3.4.6 Mongodb Mongodb 3.4.7 Mongodb Mongodb 3.4.9 Mongodb Mongodb 3.4.10 Mongodb Mongodb 3.4.11 Mongodb Mongodb 3.4.12 Mongodb Mongodb 3.4.13 Mongodb Mongodb 3.4.14 Mongodb Mongodb 3.4.15 Mongodb Mongodb 3.4.16 Mongodb Mongodb 3.4.17 Mongodb Mongodb 3.4.18 Mongodb Mongodb 3.6.0 Mongodb Mongodb 3.6.1 Mongodb Mongodb 3.6.2 Mongodb Mongodb 3.6.3 Mongodb Mongodb 3.6.4 Mongodb Mongodb 3.6.5 Mongodb Mongodb 3.6.6 Mongodb Mongodb 3.6.7 Mongodb Mongodb 3.6.8 Mongodb Mongodb 3.6.9 Mongodb Mongodb 4.0.0 Mongodb Mongodb 4.0.1 Mongodb Mongodb 4.0.2 Mongodb Mongodb 4.0.3 Mongodb Mongodb 4.0.4	33

Common Weakness Enumeration (CWE)

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

References

https://jira.mongodb.org/browse/SERVER-38070