CVE-2020-7923

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-755

Affected software

VendorProductVersions
MongoDB Inc.MongoDB Server>= 4.4, < 4.4.0-rc7; >= 4.2, < 4.2.8; >= 4.0, < 4.0.19
mongodbmongodb4.4

References

Timeline

Published
Aug 21, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-79246.5Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB CVE-2020-79257.5Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to uCVE-2020-79266.5A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant iCVE-2020-79276.5Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role priCVE-2020-79286.5A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. TCVE-2020-79296.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. ThisCVE-2020-79318.8In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorizCVE-2020-79325.7OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker CVE-2020-79345.4In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are alCVE-2020-79357.2Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous TypeCVE-2020-79366.1An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone SiteCVE-2020-79375.4An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be exe
CVE-2020-7923: Medium severity, CVSS 6.5 | Vulnix