CVE-2020-7921

Summary

Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action. This issue affects MongoDB Server v4.2 versions prior to 4.2.3; MongoDB Server v4.0 versions prior to 4.0.15; MongoDB Server v4.3 versions prior to 4.3.3and MongoDB Server v3.6 versions prior to 3.6.18.

Affected Software

VendorProductVersion RangeStatus
MongoDB Inc.MongoDB Server4.2 < 4.2.3affected
MongoDB Inc.MongoDB Server4.0 < 4.0.15affected
MongoDB Inc.MongoDB Server3.6 < 3.6.18affected
MongoDB Inc.MongoDB Server4.3 < 4.3.3affected

Weaknesses

  • CWE-182: CWE-182: Collapse of Data into Unsafe Value

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References