CVE-2018-25004

    Dashboard / Vulnerabilities / CVE-2018-25004

    CVE-2018-25004

    Published: 1 Mar 2021Last Modified: 8 Jul 2026

    Summary:

    Details: A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11.

    References: https://jira.mongodb.org/browse/SERVER-38275

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- a57d8e71e6998a2d0afde7edc11bd23e5661c915
    Fixed -b4339db12bf57ffee5b84a95c6919dbd35fe31c9

    Affected versions

    r3.6.11-rc1
    r3.6.11-rc0
    r3.6.9-rc0
    r3.6.9
    r3.6.10-rc1
    r3.6.10
    r3.6.10-rc0
    r3.6.8-rc1
    r3.6.8
    r3.6.8-rc0
    r3.6.7-rc1
    r3.6.7
    r3.6.7-rc0
    r3.6.6-rc0
    r3.6.6
    r3.6.5-rc0
    r3.6.5
    r3.6.4-rc0
    r3.6.4
    r3.6.3-rc1
    r3.6.3
    r3.6.3-rc0
    r3.6.2-rc0
    r3.6.2
    r3.6.1-rc1
    r3.6.1
    r3.6.1-rc0
    r3.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2018-25004 | CVE-DB