CVE-2021-23372 Denial of Service (DoS)
Attackers can crash the mongo-express application by exporting an empty collection as CSV, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-23372?
CVE-2021-23372 is a medium-severity denial of service vulnerability in mongo-express, published on 13 Apr 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash.
Weakness: CWE-754
Which versions are affected by CVE-2021-23372?
2 open source packages ship an affected version, including mongo-express. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mongo-express npm | All versions to 0.54.0 | None |
mongo-express npm | All versions to 0.54.0 | None |
Products include Mongo-Express Project Mongo-Express.
How do I fix CVE-2021-23372?
No fix has been published for CVE-2021-23372 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-23372 being exploited?
There is no known exploitation of CVE-2021-23372 in the wild and no public exploit code.
Other vulnerabilities in mongo-express
Sources
Also known as GHSA-m2r3-8492-vx59.