An authenticated database user can trigger a denial of service in the MongoDB BI Connector by creating a malicious view that disrupts the schema-sampling process.

This vulnerability is caused by an improper handling of failed view evaluations, which leads to a crash or permanent suspension of the schema-sampling routine. The attack requires the user to possess sufficient privileges to create a view, as specified by the PR:L (Low Privileges Required) vector.

The successful exploitation of this vulnerability results in the denial of service for SQL clients attempting to retrieve data through the BI Connector. While the CVSS score of 7.7 reflects a high impact on system availability, the business consequence includes operational downtime and the inability for analytical tools to access underlying data until manual intervention by an administrator occurs.

Immediate Action: Upgrade to MongoDB BI Connector version 2.14.31 or later to resolve the schema-sampling logic error.

Proactive Monitoring: Review database access logs to identify users creating new views in namespaces monitored by the BI Connector, particularly those exhibiting signs of repetitive failure.

Compensating Controls: Restrict the ability to create views in the database to a minimal set of trusted users to prevent unauthorized triggers of this routine.

Public Exploit Available: Unknown.

Given the High severity rating of 7.7, organizations utilizing the MongoDB BI Connector should prioritize the update to version 2.14.31. Administrators should verify their current deployment versions and schedule maintenance to apply the fix, thereby preventing potential service disruptions caused by malicious or malformed view definitions.