GHSA-p9rv-qgqw-jx2w

    Dashboard / Vulnerabilities / GHSA-p9rv-qgqw-jx2w

    GHSA-p9rv-qgqw-jx2w

    Published: 24 May 2022Last Modified: 16 Feb 2024

    Summary: MongoDB C# Driver Risk of Exposing Authentication Data via Command Listener

    Details: Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver 2.12 <= 2.12.1.

    References: https://nvd.nist.gov/vuln/detail/CVE-2021-20331, https://github.com/mongodb/mongo-csharp-driver/commit/1f1a526e93ed7aa254759704b19f5ee66a3af365, https://jira.mongodb.org/browse/CSHARP-3521

    Affected packages

    Package

    Name: mongodb.driver

    Purl: pkg:nuget/mongodb.driver

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 2.11.0
    Fixed -2.12.2

    Affected versions

    2.11.0
    2.11.1
    2.11.2
    2.11.3
    2.11.4
    2.11.5
    2.11.6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-p9rv-qgqw-jx2w | CVE-DB