CVE-2020-7925

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-475 CWE-20

Affected software

Vendor	Product	Versions
MongoDB Inc.	MongoDB Server	>= 4.2, < 4.2.9; >= 4.4, < 4.4.0-rc12

References

https://jira.mongodb.org/browse/SERVER-49142Issue Tracking, Vendor Advisory
https://jira.mongodb.org/browse/SERVER-49142Issue Tracking, Vendor Advisory

Timeline

Published: Nov 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-79266.5A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant i CVE-2020-79276.5Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role pri CVE-2020-79286.5A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. T CVE-2020-79296.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This CVE-2020-79318.8In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authoriz CVE-2020-79325.7OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker CVE-2020-79345.4In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are al CVE-2020-79357.2Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type CVE-2020-79366.1An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site CVE-2020-79375.4An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be exe CVE-2020-79388.8plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.CVE-2020-79398.8SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem i