Name: CVE-2020-7921: Collapse of Data into Unsafe Value
Creator: Rapid7
Published: 2020-05-06T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2020-7921, CWE-182, CWE-863, CVSS 4.6, EPSS 0.00179

Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action. This issue affects MongoDB Server v4.2 versions prior to 4.2.3; MongoDB Server v4.0 versions prior to 4.0.15; MongoDB Server v4.3 versions prior to 4.3.3and MongoDB Server v3.6 versions prior to 3.6.18.

CVSS Details

CVSS 3.1 Base Score: 4.6
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Freebsd	—	Upgrade mongodb36Upgrade mongodb40Upgrade mongodb42	Jun 30, 2020	Jun 29, 2020
Mongodb	—	Upgrade MongoDB to version 4.3.3Upgrade MongoDB to version 4.2.3Upgrade MongoDB to version 4.0.15Upgrade to the latest version of MongoDBUpgrade MongoDB to version 3.6.18	May 14, 2020	May 6, 2020

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence