CVE-2021-32036: 
MongoDB vulnerability analysis and mitigation

MongoDB database was found to contain a vulnerability (CVE-2021-32036) where an authenticated user without specific authorizations could repeatedly invoke the features command. The vulnerability affects MongoDB Server versions 5.0.0-5.0.3, 4.4.0-4.4.9, 4.2.0-4.2.16, and all prior versions back to 4.0.28. This security flaw was discovered internally and disclosed in 2021 (MongoDB Jira).

The vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling. It received a CVSS 3.1 score of 5.4 with the following metrics: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The technical assessment indicates that the vulnerability requires network access and low complexity to exploit, with low privileges required and no user interaction needed (MongoDB Jira).

The vulnerability can lead to two primary impacts: resource depletion and high lock contention, potentially resulting in denial of service. In rare cases, it could also cause ID field collisions, affecting data integrity (MongoDB Jira).

MongoDB has addressed this vulnerability through patches in versions 4.2.18, 4.4.10, 5.0.4, and 5.1.0-rc0. Users are advised to upgrade to these or later versions to mitigate the vulnerability (MongoDB Jira).