Vulnerability · Published Nov 24, 2021 · Assigned by mongodb

CVE-2021-32037User may trigger invariant when allowed to send commands directly to shards

Medium 6.5

In plain English

A medium-severity security flaw in MongoDB Server from MongoDB Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.2%top 30.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually, the requests are sent via mongos and special privileges are required in order to know the address of the shards and to log in to the shards of an auth enabled environment. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.2.

Affected products (as reported)

Vendor	Product	Versions
MongoDB Inc.	MongoDB Server	5.0 – through 5.0.2

Weakness: CWE-617 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://jira.mongodb.org/browse/SERVER-59071 x_refsource_MISC