Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-qg39-5q45-4gcc

Опубликовано: 30 мар. 2026
Источник: github
Github: Не прошло ревью
CVSS4: 6
CVSS3: 5.3

Описание

A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set.

This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.

A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set.

This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.

EPSS

Процентиль: 14%
0.00047
Низкий

6 Medium

CVSS4

5.3 Medium

CVSS3

Дефекты

CWE-617

Связанные уязвимости

CVSS3: 5.3
ubuntu
15 дней назад

A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set. This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.

CVSS3: 5.3
nvd
15 дней назад

A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set. This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.

CVSS3: 5.3
debian
15 дней назад

A user with access to the cluster with a limited set of privilege acti ...

EPSS

Процентиль: 14%
0.00047
Низкий

6 Medium

CVSS4

5.3 Medium

CVSS3

Дефекты

CWE-617