CVE-2020-7928

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects MongoDB Server v4.4 versions prior to 4.4.1; MongoDB Server v4.2 versions prior to 4.2.9; MongoDB Server v4.0 versions prior to 4.0.20 and MongoDB Server v3.6 versions prior to 3.6.20.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-158

Affected software

Vendor	Product	Versions
MongoDB Inc.	MongoDB Server	>= 4.4, < 4.4.1; >= 4.2, < 4.2.9; >= 4.0, < 4.0.20; >= 3.6, < 3.6.20

References

https://jira.mongodb.org/browse/SERVER-49404Issue Tracking, Patch, Vendor Advisory
https://jira.mongodb.org/browse/SERVER-49404Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Nov 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-79296.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This CVE-2020-79318.8In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authoriz CVE-2020-79325.7OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker CVE-2020-79345.4In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are al CVE-2020-79357.2Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type CVE-2020-79366.1An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site CVE-2020-79375.4An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be exe CVE-2020-79388.8plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.CVE-2020-79398.8SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem i CVE-2020-79407.5Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.CVE-2020-79419.8A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needi CVE-2020-79426.5Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a comprom