Improper Neutralization of Null Byte or NUL Character in MongoDB - CVE-2020-7928
Published: November 23, 2020 / Updated: November 25, 2020
Vulnerability identifier: #VU48658
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-7928
CWE-ID: CWE-158
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information on the system.
The vulnerability exists due to the affected software does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component. A remote authenticated attacker can trigger a read overrun and access arbitrary memory by issuing specially crafted queries.
Affected software
MongoDB
IBM Cloud Automation Manager
IBM Cloud Automation Manager
How to mitigate CVE-2020-7928
Install updates from vendor's website.
MongoDB - addressed in versions 3.6.20, 4.0.20, 4.2.9, 4.4.1, 4.5.1
IBM Cloud Automation Manager - update to 4.2.0.1 iFix 2
IBM Cloud Automation Manager - update to 4.2.0.1 iFix 2