title: Denial of Service and Data Integrity vulnerability in features command
description: An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28
problem types: CWE-770: Allocation of Resources Without Limits or Throttling
affected:
{
defaultStatus: unaffected
product: MongoDB Server
vendor: MongoDB Inc.
versions:
lessThanOrEqual: 5.0.3, status: affected, version: 5.0, versionType: custom
lessThanOrEqual: 4.4.9, status: affected, version: 4.4, versionType: custom
lessThanOrEqual: 4.2.16, status: affected, version: 4.2, versionType: custom
lessThanOrEqual: 4.0.28, status: affected, version: 4.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL