CVE-2021-20331 MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application

2021-05-1307:40:11

CWE-200

mongodb

github.com

mongodb

c# driver

command listener

authentication data

security sensitive

log file

v2.12.1

CVSS3

4.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

AI Score

4.9

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as “saslStart”, “saslContinue”, “isMaster”, “createUser”, and “updateUser” are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:mongodb:c\\#_driver:*:*:*:*:*:mongodb:*:*"
    ],
    "vendor": "mongodb",
    "product": "c\\#_driver",
    "versions": [
      {
        "status": "affected",
        "version": "2.12",
        "versionType": "custom",
        "lessThanOrEqual": "2.12.1"
      }
    ],
    "defaultStatus": "unknown"
  }
]