CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20334 – Local privilege escalation in MongoDB Compass for Windows
https://notcve.org/view.php?id=CVE-2021-20334
A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x versions prior to 1.25.0 on Windows. Un tercero malicioso con acceso local a la máquina de Windows donde MongoDB Compass está instalado puede ejecutar software arbitrario con los privilegios del usuario que está ejecutando MongoDB Compass. Este problema afecta a: MongoDB Inc. • https://jira.mongodb.org/browse/COMPASS-4510 • CWE-269: Improper Privilege Management •
CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0CVE-2018-25004 – Invariant failure when explaining a find with a UUID
https://notcve.org/view.php?id=CVE-2018-25004
A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11. Un usuario autorizado para llevar a cabo un tipo específico de consulta puede desencadenar una denegación de servicio al emitir un comando de explicación genérico en una consulta de búsqueda. Este problema afecta a: MongoDB Inc. MongoDB Server versiones v4.0 anteriores a 4.0.6; MongoDB Server versiones v3.6 anteriores a 3.6.11 • https://jira.mongodb.org/browse/SERVER-38275 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-7929 – Specially crafted regex query can cause DoS
https://notcve.org/view.php?id=CVE-2020-7929
A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20. Un usuario autorizado para llevar a cabo consultas a la base de datos puede desencadenar una denegación de servicio cuando se emite una consulta especialmente diseñada que contenga un tipo de expresión regular. Este problema afecta a: MongoDB Inc. MongoDB Server versiones v3.6 anteriores a 3.6.21 y MongoDB Server versiones v4.0 anteriores a 4.0.20 • https://jira.mongodb.org/browse/SERVER-51083 • CWE-185: Incorrect Regular Expression •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2021-20328 – MongoDB Java driver client-side field level encryption not verifying KMS host name
https://notcve.org/view.php?id=CVE-2021-20328
Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. • https://jira.mongodb.org/browse/JAVA-4017 https://access.redhat.com/security/cve/CVE-2021-20328 https://bugzilla.redhat.com/show_bug.cgi?id=1934236 • CWE-295: Improper Certificate Validation •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20327 – MongoDB Node.js client side field level encryption library may not be validating KMS certificate
https://notcve.org/view.php?id=CVE-2021-20327
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption. • https://jira.mongodb.org/browse/NODE-3125 • CWE-295: Improper Certificate Validation •