Vulnerability-Lookup

CVE-2020-7923 (GCVE-0-2020-7923)

Vulnerability from cvelistv5 – Published: 2020-08-21 14:25 – Updated: 2024-09-17 02:27

Title

Specific GeoQuery can cause DoS against MongoDB Server

Summary

A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-22 18:48 UTC

CWE

CWE-755 - Improper Handling of Exceptional Conditions

Assigner

mongodb mitre root

References

1 reference

URL	Tags
https://jira.mongodb.org/browse/SERVER-47773	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
MongoDB Inc.	MongoDB Server	Affected: 4.4 , < 4.4.0-rc7 (custom) Affected: 4.2 , < 4.2.8 (custom) Affected: 4.0 , < 4.0.19 (custom)
mongodb	mongodb	Affected: 4.4 cpe:2.3:a:mongodb:mongodb:-:::::::*

Date Public

2020-08-20 23:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mongodb:mongodb:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mongodb",
            "vendor": "mongodb",
            "versions": [
              {
                "status": "affected",
                "version": "4.4"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-7923",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-22T18:48:55.411971Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:12:12.302Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:48:24.552Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.mongodb.org/browse/SERVER-47773"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MongoDB Server",
          "vendor": "MongoDB Inc.",
          "versions": [
            {
              "lessThan": "4.4.0-rc7",
              "status": "affected",
              "version": "4.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.8",
              "status": "affected",
              "version": "4.2",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.19",
              "status": "affected",
              "version": "4.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2020-08-20T23:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19.\u003c/p\u003e"
            }
          ],
          "value": "A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755 Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-23T15:13:08.850Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.mongodb.org/browse/SERVER-47773"
        }
      ],
      "source": {
        "defect": [
          "SECURITY-658"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Specific GeoQuery can cause DoS against MongoDB Server",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@mongodb.com",
          "DATE_PUBLIC": "2020-08-21T14:40:00.000Z",
          "ID": "CVE-2020-7923",
          "STATE": "PUBLIC",
          "TITLE": "Specific GeoQuery can cause DoS against MongoDB Server"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MongoDB Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.4",
                            "version_value": "4.4.0-rc7"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.2",
                            "version_value": "4.2.8"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.0",
                            "version_value": "4.0.19"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "MongoDB Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc7; v4.2 versions prior to 4.2.8; v4.0 versions prior to 4.0.19."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-755 Improper Handling of Exceptional Conditions"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.mongodb.org/browse/SERVER-47773",
              "refsource": "MISC",
              "url": "https://jira.mongodb.org/browse/SERVER-47773"
            }
          ]
        },
        "source": {
          "defect": [
            "SECURITY-658"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2020-7923",
    "datePublished": "2020-08-21T14:25:12.201Z",
    "dateReserved": "2020-01-23T00:00:00.000Z",
    "dateUpdated": "2024-09-17T02:27:47.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-7923",
      "date": "2026-10-03",
      "epss": "0.01286",
      "percentile": "0.69143"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T09:48:24.552Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://jira.mongodb.org/browse/SERVER-47773"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:mongodb:mongodb:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "mongodb",
                "vendor": "mongodb",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.4"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2020-7923",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-04-22T18:48:55.411971Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-04-22T18:48:10.220Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "MongoDB Server",
              "vendor": "MongoDB Inc.",
              "versions": [
                {
                  "lessThan": "4.4.0-rc7",
                  "status": "affected",
                  "version": "4.4",
                  "versionType": "custom"
                },
                {
                  "lessThan": "4.2.8",
                  "status": "affected",
                  "version": "4.2",
                  "versionType": "custom"
                },
                {
                  "lessThan": "4.0.19",
                  "status": "affected",
                  "version": "4.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "datePublic": "2020-08-20T23:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19.\u003c/p\u003e"
                }
              ],
              "value": "A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-755",
                  "description": "CWE-755 Improper Handling of Exceptional Conditions",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-01-23T15:13:08.850Z",
            "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
            "shortName": "mongodb"
          },
          "references": [
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://jira.mongodb.org/browse/SERVER-47773"
            }
          ],
          "source": {
            "defect": [
              "SECURITY-658"
            ],
            "discovery": "INTERNAL"
          },
          "title": "Specific GeoQuery can cause DoS against MongoDB Server",
          "x_generator": {
            "engine": "Vulnogram 0.0.9"
          },
          "x_legacyV4Record": {
            "CVE_data_meta": {
              "ASSIGNER": "cna@mongodb.com",
              "DATE_PUBLIC": "2020-08-21T14:40:00.000Z",
              "ID": "CVE-2020-7923",
              "STATE": "PUBLIC",
              "TITLE": "Specific GeoQuery can cause DoS against MongoDB Server"
            },
            "affects": {
              "vendor": {
                "vendor_data": [
                  {
                    "product": {
                      "product_data": [
                        {
                          "product_name": "MongoDB Server",
                          "version": {
                            "version_data": [
                              {
                                "version_affected": "\u003c",
                                "version_name": "4.4",
                                "version_value": "4.4.0-rc7"
                              },
                              {
                                "version_affected": "\u003c",
                                "version_name": "4.2",
                                "version_value": "4.2.8"
                              },
                              {
                                "version_affected": "\u003c",
                                "version_name": "4.0",
                                "version_value": "4.0.19"
                              }
                            ]
                          }
                        }
                      ]
                    },
                    "vendor_name": "MongoDB Inc."
                  }
                ]
              }
            },
            "data_format": "MITRE",
            "data_type": "CVE",
            "data_version": "4.0",
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc7; v4.2 versions prior to 4.2.8; v4.0 versions prior to 4.0.19."
                }
              ]
            },
            "generator": {
              "engine": "Vulnogram 0.0.9"
            },
            "impact": {
              "cvss": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            },
            "problemtype": {
              "problemtype_data": [
                {
                  "description": [
                    {
                      "lang": "eng",
                      "value": "CWE-755 Improper Handling of Exceptional Conditions"
                    }
                  ]
                }
              ]
            },
            "references": {
              "reference_data": [
                {
                  "name": "https://jira.mongodb.org/browse/SERVER-47773",
                  "refsource": "MISC",
                  "url": "https://jira.mongodb.org/browse/SERVER-47773"
                }
              ]
            },
            "source": {
              "defect": [
                "SECURITY-658"
              ],
              "discovery": "INTERNAL"
            }
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "assignerShortName": "mongodb",
        "cveId": "CVE-2020-7923",
        "datePublished": "2020-08-21T14:25:12.201Z",
        "dateReserved": "2020-01-23T00:00:00.000Z",
        "dateUpdated": "2024-09-17T02:27:47.252Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

9AKK108472A9037

Vulnerability from csaf_abb - Published: 2026-07-30 00:30 - Updated: 2026-07-30 00:30

Summary

ABB AbilityTM zenon Security Risk Due to End-of-Life MongoDB Component

Scope

13 vulnerabilities in this advisory, including CVE-2020-7923.

CVE-2020-7923

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:U/RC:C

Known affected: 1 product

Open the full advisory

bit-mongodb-2020-7923

Vulnerability from bitnami_vulndb

Published

2024-03-06 10:59

Modified

2026-09-08 08:34

Summary

Specific GeoQuery can cause DoS against MongoDB Server

Details

A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "mongodb",
        "purl": "pkg:bitnami/mongodb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.19"
            },
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "4.2.8"
            },
            {
              "introduced": "4.4.0"
            },
            {
              "fixed": "4.4.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-7923"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
  },
  "details": "A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19.",
  "id": "BIT-mongodb-2020-7923",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2024-03-06T10:59:03.972Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://jira.mongodb.org/browse/SERVER-47773"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7923"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Specific GeoQuery can cause DoS against MongoDB Server"
}

FKIE_CVE-2020-7923

Vulnerability from fkie_nvd - Published: 2020-08-21 15:15 - Updated: 2026-06-17 03:25

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	cna@mongodb.com	https://jira.mongodb.org/browse/SERVER-47773	Issue Tracking, Patch, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://jira.mongodb.org/browse/SERVER-47773	Issue Tracking, Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
mongodb	mongodb	*
mongodb	mongodb	*
mongodb	mongodb	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "MongoDB Server",
          "vendor": "MongoDB Inc.",
          "versions": [
            {
              "lessThan": "4.4.0-rc7",
              "status": "affected",
              "version": "4.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.8",
              "status": "affected",
              "version": "4.2",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.19",
              "status": "affected",
              "version": "4.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "cna@mongodb.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mongodb:mongodb:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "mongodb",
          "vendor": "mongodb",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "38CB828C-5F5F-476C-9644-543FDB6573BA",
              "versionEndExcluding": "4.0.19",
              "versionStartIncluding": "4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DA31477-9685-4A7D-888E-45222DC780C9",
              "versionEndExcluding": "4.2.8",
              "versionStartIncluding": "4.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1B0B3E97-0E31-4904-95C6-1F7B8252606D",
              "versionEndExcluding": "4.4.0",
              "versionStartIncluding": "4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19."
    },
    {
      "lang": "es",
      "value": "Un usuario autorizado para llevar a cabo consultas en la base de datos puede causar una denegaci\u00f3n de servicio al emitir consultas especialmente dise\u00f1adas, que violan una invariante en el soporte del subsistema de consultas para geoNear. Este problema afecta a: MongoDB Server de MongoDB Inc versiones v4.4 anteriores a 4.4.0-rc7; versiones v4.2 anteriores a 4.2.8; versiones v4.0 anteriores a 4.0.19"
    }
  ],
  "id": "CVE-2020-7923",
  "lastModified": "2026-06-17T03:25:38.263",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "cna@mongodb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2020-7923",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-04-22T18:48:55.411971Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2020-08-21T15:15:13.273",
  "references": [
    {
      "source": "cna@mongodb.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://jira.mongodb.org/browse/SERVER-47773"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://jira.mongodb.org/browse/SERVER-47773"
    }
  ],
  "sourceIdentifier": "cna@mongodb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-755"
        }
      ],
      "source": "cna@mongodb.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-755"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-2CG2-X4M3-3VPP

Vulnerability from github – Published: 2022-05-24 17:26 – Updated: 2023-02-03 03:30

Details

A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects: MongoDB Inc. MongoDB Server v4.5 versions prior to 4.5.1; v4.4 versions prior to 4.4.0-rc7; v4.2 versions prior to 4.2.8; v4.0 versions prior to 4.0.19.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-7923"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-755"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-08-21T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects: MongoDB Inc. MongoDB Server v4.5 versions prior to 4.5.1; v4.4 versions prior to 4.4.0-rc7; v4.2 versions prior to 4.2.8; v4.0 versions prior to 4.0.19.",
  "id": "GHSA-2cg2-x4m3-3vpp",
  "modified": "2023-02-03T03:30:25Z",
  "published": "2022-05-24T17:26:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7923"
    },
    {
      "type": "WEB",
      "url": "https://jira.mongodb.org/browse/SERVER-47773"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00041.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2020-7923

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc7; v4.2 versions prior to 4.2.8; v4.0 versions prior to 4.0.19.

Aliases

CVE-2020-7923

Aliases

CVE-2020-7923

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-7923",
    "description": "A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc7; v4.2 versions prior to 4.2.8; v4.0 versions prior to 4.0.19.",
    "id": "GSD-2020-7923",
    "references": [
      "https://advisories.mageia.org/CVE-2020-7923.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-7923"
      ],
      "details": "A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc7; v4.2 versions prior to 4.2.8; v4.0 versions prior to 4.0.19.",
      "id": "GSD-2020-7923",
      "modified": "2023-12-13T01:21:52.250179Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cna@mongodb.com",
        "ID": "CVE-2020-7923",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "MongoDB Server",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "4.4",
                          "version_value": "4.4.0-rc7"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_name": "4.2",
                          "version_value": "4.2.8"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_name": "4.0",
                          "version_value": "4.0.19"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "MongoDB Inc."
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19.\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-755",
                "lang": "eng",
                "value": "CWE-755 Improper Handling of Exceptional Conditions"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://jira.mongodb.org/browse/SERVER-47773",
            "refsource": "MISC",
            "url": "https://jira.mongodb.org/browse/SERVER-47773"
          }
        ]
      },
      "source": {
        "defect": [
          "SECURITY-658"
        ],
        "discovery": "INTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38CB828C-5F5F-476C-9644-543FDB6573BA",
                    "versionEndExcluding": "4.0.19",
                    "versionStartIncluding": "4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0DA31477-9685-4A7D-888E-45222DC780C9",
                    "versionEndExcluding": "4.2.8",
                    "versionStartIncluding": "4.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1B0B3E97-0E31-4904-95C6-1F7B8252606D",
                    "versionEndExcluding": "4.4.0",
                    "versionStartIncluding": "4.4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19.\n\n"
          },
          {
            "lang": "es",
            "value": "Un usuario autorizado para llevar a cabo consultas en la base de datos puede causar una denegaci\u00f3n de servicio al emitir consultas especialmente dise\u00f1adas, que violan una invariante en el soporte del subsistema de consultas para geoNear. Este problema afecta a: MongoDB Server de MongoDB Inc versiones v4.4 anteriores a 4.4.0-rc7; versiones v4.2 anteriores a 4.2.8; versiones v4.0 anteriores a 4.0.19"
          }
        ],
        "id": "CVE-2020-7923",
        "lastModified": "2024-01-23T16:15:48.907",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 4.0,
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "cna@mongodb.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2020-08-21T15:15:13.273",
        "references": [
          {
            "source": "cna@mongodb.com",
            "tags": [
              "Issue Tracking",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://jira.mongodb.org/browse/SERVER-47773"
          }
        ],
        "sourceIdentifier": "cna@mongodb.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-755"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-755"
              }
            ],
            "source": "cna@mongodb.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

ICSA-26-218-01

Vulnerability from csaf_cisa - Published: 2026-07-30 00:30 - Updated: 2026-08-06 06:00

Summary

ABB Ability Zenon

Scope

13 vulnerabilities in this advisory, including CVE-2020-7923.

CVE-2020-7923

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:U/RC:C

Known affected: 1 product

Open the full advisory

UBUNTU-CVE-2020-7923 (CVE-2020-7923)

Vulnerability from osv_ubuntu – Published: 2020-08-21 15:15 – Updated: 2026-04-13 09:17 – Source website

Details

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2020-7923	REPORT
	https://jira.mongodb.org/browse/SERVER-47773	REPORT
	https://github.com/mongodb/mongo/commit/c8ced6df8…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2020-7923	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "mongodb",
            "binary_version": "1:3.6.3-0ubuntu1.4+esm2"
          },
          {
            "binary_name": "mongodb-clients",
            "binary_version": "1:3.6.3-0ubuntu1.4+esm2"
          },
          {
            "binary_name": "mongodb-server",
            "binary_version": "1:3.6.3-0ubuntu1.4+esm2"
          },
          {
            "binary_name": "mongodb-server-core",
            "binary_version": "1:3.6.3-0ubuntu1.4+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "mongodb",
        "purl": "pkg:deb/ubuntu/mongodb@1:3.6.3-0ubuntu1.4+esm2?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:3.4.7-1",
        "1:3.4.7-1ubuntu1",
        "1:3.4.7-1ubuntu2",
        "1:3.4.7-1ubuntu4",
        "1:3.4.14-3ubuntu1",
        "1:3.4.14-3ubuntu2",
        "1:3.6.3-0ubuntu1",
        "1:3.6.3-0ubuntu1.1",
        "1:3.6.3-0ubuntu1.3",
        "1:3.6.3-0ubuntu1.4",
        "1:3.6.3-0ubuntu1.4+esm1",
        "1:3.6.3-0ubuntu1.4+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "mongodb",
            "binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
          },
          {
            "binary_name": "mongodb-clients",
            "binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
          },
          {
            "binary_name": "mongodb-server",
            "binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
          },
          {
            "binary_name": "mongodb-server-core",
            "binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "mongodb",
        "purl": "pkg:deb/ubuntu/mongodb@1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu2",
        "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5",
        "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2",
        "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3",
        "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
      ]
    }
  ],
  "aliases": [],
  "details": "A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem\u0027s support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19.",
  "id": "UBUNTU-CVE-2020-7923",
  "modified": "2026-04-13T09:17:20Z",
  "published": "2020-08-21T15:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-7923"
    },
    {
      "type": "REPORT",
      "url": "https://jira.mongodb.org/browse/SERVER-47773"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/mongodb/mongo/commit/c8ced6df8f620daaa2e539f192f2eef356c63e9c"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7923"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2020-7923"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2020-7923 (GCVE-0-2020-7923)

9AKK108472A9037

bit-mongodb-2020-7923

Vulnerability from bitnami_vulndb

FKIE_CVE-2020-7923

GHSA-2CG2-X4M3-3VPP

GSD-2020-7923

ICSA-26-218-01

UBUNTU-CVE-2020-7923 (CVE-2020-7923)

Tags

Sightings

Nomenclature

Related by attack behaviour