Information Exposure Affecting mongodb.driver Open this link in a new tab package, versions [2.11.0, 2.12.2)
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Confidentiality
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-DOTNET-MONGODBDRIVER-1292153
-
published
13 May 2021
-
disclosed
13 May 2021
-
credit
Unknown
Introduced: 13 May 2021
CVE-2021-20331 Open this link in a new tabHow to fix?
Upgrade MongoDB.Driver
to version 2.12.2 or higher.
Overview
MongoDB.Driver is an Official .NET driver for MongoDB.
Affected versions of this package are vulnerable to Information Exposure. MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as saslStart
, saslContinue
, isMaster
, createUser
, and updateUser
are executed.
Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file.
Note: This issue only arises if an application enables the command listener feature (this is not enabled by default).