What is the CVSS score of CVE-2021-20328?

CVE-2021-20328 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2021-20328?

Yes, a patch is available for CVE-2021-20328. Update the affected software to the latest version immediately.

Java CVE-2021-20328

MEDIUM

Improper Certificate Validation (CWE-295)

2021-02-25 cna@mongodb.com

Microsoft Information Disclosure Java Java Driver Quarkus

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Feb 25, 2021 - 17:15 nvd

MEDIUM 6.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

321 maven packages depend on org.mongodb:mongo-java-driver (47 direct, 275 indirect)
43 maven packages depend on org.mongodb:mongodb-driver (13 direct, 30 indirect)
7 maven packages depend on org.mongodb:mongodb-driver-legacy (2 direct, 5 indirect)
19 maven packages depend on org.mongodb:mongodb-driver-sync (10 direct, 9 indirect)

Ecosystem-wide dependent count for version 3.11.0 and other introduced versions.

DescriptionNVD

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

AnalysisAI

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required.

Technical ContextAI

This vulnerability is classified under CWE-295. Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption. Affected products include: Mongodb Java Driver, Quarkus.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.