Vulnerabilities > CVE-2019-2393 - Use After Free vulnerability in Mongodb

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

mongodb

CWE-416

NVD

Published: 2020-11-23

Updated: 2024-01-23

Summary

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use $lookup and collations. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13 and MongoDB Server v3.6 versions prior to 3.6.15.

Vulnerable Configurations

Part	Description	Count
Application	Mongodb Mongodb Mongodb 3.6.0 Mongodb Mongodb 3.6.1 Mongodb Mongodb 3.6.2 Mongodb Mongodb 3.6.3 Mongodb Mongodb 3.6.4 Mongodb Mongodb 3.6.5 Mongodb Mongodb 3.6.6 Mongodb Mongodb 3.6.7 Mongodb Mongodb 3.6.8 Mongodb Mongodb 3.6.9 Mongodb Mongodb 3.6.10 Mongodb Mongodb 3.6.11 Mongodb Mongodb 3.6.12 Mongodb Mongodb 3.6.13 Mongodb Mongodb 3.6.14 Mongodb Mongodb 4.0.0 Mongodb Mongodb 4.0.1 Mongodb Mongodb 4.0.2 Mongodb Mongodb 4.0.3 Mongodb Mongodb 4.0.4 Mongodb Mongodb 4.0.5 Mongodb Mongodb 4.0.6 Mongodb Mongodb 4.0.7 Mongodb Mongodb 4.0.8 Mongodb Mongodb 4.0.9 Mongodb Mongodb 4.0.10 Mongodb Mongodb 4.0.11 Mongodb Mongodb 4.0.12 Mongodb Mongodb 4.2.0	29

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

References

https://jira.mongodb.org/browse/SERVER-43350