Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application
CVE-2021-32050

4.2MEDIUM

Key Information:

Vendor

MongoDB
Status
Mongodb C Driver
Mongodb C++ Driver
Mongodb PHP Driver
Mongodb Swift Driver
Vendor
CVE Published:
29 August 2023

What is CVE-2021-32050?

Certain MongoDB Drivers may mistakenly expose sensitive authentication data through a command listener that can be configured by applications. When specific authentication commands are executed, this information is published as events. If an application has the command listener feature enabled-a setting that is not activated by default-it may inadvertently log this sensitive information, posing a significant risk of data exposure. Users are encouraged to review product versions and implement protections accordingly.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

MongoDB C Driver 1.0.0 < 1.17.7

MongoDB C++ Driver 3.0.0 < 3.7.0

MongoDB Node.js Driver 3.6 < 3.6.10

References

https://jira.mongodb.org/browse/PHPC-1869
https://jira.mongodb.org/browse/CXX-2028
https://jira.mongodb.org/browse/SWIFT-1229

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.