CVE-2021-20331

    Dashboard / Vulnerabilities / CVE-2021-20331

    CVE-2021-20331

    Published: 13 May 2021Last Modified: 8 Jul 2026

    Summary:

    Details: Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1.

    References: https://jira.mongodb.org/browse/CSHARP-3521

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e75af27dc5966e9315d04f73ffa2c42549318a02
    Fixed -a4a3888f4fb51bb518b1eb5002effc2d47f2ea6a

    Affected versions

    2.11.0-NA

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-20331 | CVE-DB