CVE-2021-32036
Assigner: mongodb
Published: 2022-02-04T00:00:00
State: PUBLISHED
affected: defaultStatus: unaffected
product: MongoDB Server
vendor: MongoDB Inc.
versions: lessThanOrEqual: 5.0.3
status: affected
version: 5.0
versionType: custom
lessThanOrEqual: 4.4.9
status: affected
version: 4.4
versionType: custom
lessThanOrEqual: 4.2.16
status: affected
version: 4.2
versionType: custom
lessThanOrEqual: 4.0.28
status: affected
version: 4.0
versionType: custom
datePublic: 2022-02-04T00:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <p>An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28</p>
value: An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
type: CWE
source: discovery: INTERNAL
title: Denial of Service and Data Integrity vulnerability in features command
x_generator: engine: Vulnogram 0.0.9