CVE-2018-20802

MEDIUM

Post-auth queries on compound index may crash mongod

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2018-20802 has a selected CVSS score of 6.5 (medium).

Description

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3.

Description source: CVE List

Affected products and versions

1
ProductSourceVersion range

MongoDB Server

Browse MongoDB Inc. / MongoDB Server

Default status: unaffected

CVE List3.6 to < 3.6.9affected
4.0 to < 4.0.3affected

References

2