Vulnerability · Published Dec 15, 2021 · Assigned by mongodb

CVE-2021-20330Specific replication command with malformed oplog entries can crash secondaries

Medium 6.5

In plain English

A medium-severity improper input validation in MongoDB Server from MongoDB Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.1%top 34.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9.

Affected products (as reported)

Vendor	Product	Versions
MongoDB Inc.	MongoDB Server	4.0 – before 4.0.274.2 – before 4.2.164.4 – before 4.4.9

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://jira.mongodb.org/browse/SERVER-36263 x_refsource_MISC