CVE-2019-20923

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0 versions prior to 4.0.7.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-749

Affected software

VendorProductVersions
MongoDB Inc.MongoDB Server>= 4.0, < 4.0.7
mongodbmongodb_server4.0

References

Timeline

Published
Nov 23, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-209246.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant CVE-2019-209257.5An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decomprCVE-2019-20938.8In huff_dec_1D of nlc_dec.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code executiCVE-2019-209339.8InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT tokCVE-2019-209345.3An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats(CVE-2019-20947.8In parseMPEGCCData of NuPlayerCCDecoder.cpp, there is a possible out of bounds write due to missing bounds checks. This could lead to remoteCVE-2019-20957.0In callGenIDChangeListeners and related functions of SkPixelRef.cpp, there is a possible use after free due to a race condition. This could CVE-2019-20967.8In EffectRelease of EffectBundle.cpp, there is a possible memory corruption due to a double free. This could lead to local escalation of priCVE-2019-20979.8In HAliasAnalyzer.Query of hydrogen-alias-analysis.h, there is possible memory corruption due to type confusion. This could lead to remote cCVE-2019-20987.8In areNotificationsEnabledForPackage of NotificationManagerService.java, there is a possible permissions bypass due to a missing permissionsCVE-2019-20997.8In nfa_rw_store_ndef_rx_buf of nfa_rw_act.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead to localCVE-2019-21015.5In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input validation. This could lead to lo
CVE-2019-20923: Medium severity, CVSS 6.5 | Vulnix