CVE-2020-7928: 
MongoDB vulnerability analysis and mitigation

A vulnerability in MongoDB Server (CVE-2020-7928) allows authorized users to trigger a read overrun and access arbitrary memory through specially crafted database queries. The vulnerability affects multiple versions of MongoDB Server: v4.4 versions prior to 4.4.1, v4.2 versions prior to 4.2.9, v4.0 versions prior to 4.0.20, and v3.6 versions prior to 3.6.20 (MongoDB Jira).

The vulnerability is classified as an Improper Neutralization of Null Byte or NUL Character (CWE-158). It received a CVSS v3.1 score of 6.5, with the following metrics: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability was discovered and reported on July 09, 2020, and was resolved on July 28, 2020 (MongoDB Jira).

When exploited, this vulnerability allows authorized users to access arbitrary memory through read overrun operations, potentially exposing sensitive information stored in the server's memory (MongoDB Jira).

The vulnerability requires valid user credentials and the ability to perform database queries. No known exploits were available in the wild at the time of disclosure (ManageEngine).

MongoDB addressed this vulnerability by releasing patched versions: 4.4.1, 4.2.9, 4.0.20, and 3.6.20. Users are advised to upgrade to these or later versions to mitigate the vulnerability (MongoDB Jira).