CVE-2019-2392: 
MongoDB vulnerability analysis and mitigation

CVE-2019-2392 is a vulnerability in MongoDB Server that affects multiple versions of the software. A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries that use the $mod operator to overflow negative values. The vulnerability affects MongoDB Server versions 4.4 prior to 4.4.1, 4.2 prior to 4.2.9, 4.0 prior to 4.0.20, and 3.6 prior to 3.6.20 (MongoDB JIRA).

The vulnerability is classified as CWE-190: Integer Overflow or Wraparound. It has a CVSS v3.1 base score of 6.5 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. This indicates that the vulnerability is network exploitable, requires low attack complexity, requires low privileges, needs no user interaction, has unchanged scope, and can only impact availability (MongoDB JIRA).

The successful exploitation of this vulnerability can result in denial of service to the MongoDB server through specially crafted queries using the $mod operator. The impact is limited to availability, with no effect on confidentiality or integrity of the system (MongoDB JIRA).

The vulnerability requires an attacker to have authorized access to perform database queries. The attack can be executed remotely over the network and requires low complexity to exploit (MongoDB JIRA).

The recommended mitigation is to upgrade to the following patched versions: MongoDB 4.4.1 or later, 4.2.9 or later, 4.0.20 or later, or 3.6.20 or later, depending on your current version (MongoDB JIRA).