Description
A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.
Remediation
References
Related Vulnerabilities
WordPress Plugin Events Manager Multiple Cross-Site Scripting Vulnerabilities (5.3.3)
WordPress Plugin WP Symposium 'get_profile_avatar.php' SQL Injection (0.64)
WordPress Plugin Genesis Simple Share Cross-Site Scripting (1.0.6)
WordPress Plugin Judge.me Product Reviews for WooCommerce Cross-Site Scripting (1.3.20)
Oracle HTTP Server Improper Encoding or Escaping of Output Vulnerability (CVE-2022-25235)