CVE-2022-24272

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-24272
An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mongod denial of service or server crash. This issue affects: MongoDB Inc. MongoDB Server v5.0 versions, prior to and including v5.0.6.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://jira.mongodb.org/browse/SERVER-63968 Issue Tracking Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
History

11 May 2022, 20:14

Type Values Removed Values Added
References (MISC) https://jira.mongodb.org/browse/SERVER-63968 - (MISC) https://jira.mongodb.org/browse/SERVER-63968 - Issue Tracking, Patch, Vendor Advisory
CWE CWE-617
CPE cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : 4.0
v3 : 6.5

11 May 2022, 15:15

Type Values Removed Values Added
References
  • (MISC) https://jira.mongodb.org/browse/SERVER-63968 -
Summary ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage. An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mongod denial of service or server crash. This issue affects: MongoDB Inc. MongoDB Server v5.0 versions, prior to and including v5.0.6.

22 Apr 2022, 16:15

Type Values Removed Values Added
Summary An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mongod denial of service or server crash. This issue affects: MongoDB Inc. MongoDB Server v5.0 versions, prior to and including v5.0.6. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.
References
  • {'url': 'https://jira.mongodb.org/browse/SERVER-63968', 'name': 'https://jira.mongodb.org/browse/SERVER-63968', 'tags': [], 'refsource': 'MISC'}

21 Apr 2022, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-04-21 11:15

Updated : 2024-02-04 22:29

NVD link : CVE-2022-24272

Mitre link : CVE-2022-24272

CVE.ORG link : CVE-2022-24272

JSON object : View

Products Affected

mongodb

  • mongodb
CWE
CWE-617

Reachable Assertion