C Driver
CVE-2021-20331
MEDIUM
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Specific versions of the MongoDB C
Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C
Driver v2.12 versions prior to and including 2.12.1.
AnalysisAI
Specific versions of the MongoDB C
Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Technical ContextAI
This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. Specific versions of the MongoDB C
Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default).12 versions prior to and including 2.12.1. Affected products include: Mongodb C\
Driver.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. Rated medium
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected mul
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underl
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress s
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthentica
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are
The legacy GridFS API in the MongoDB C Driver fails to validate file metadata fields retrieved from the database, enabli
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged atta
Namespace injection in MongoDB C Driver (libmongoc) allows any caller-controlled database or collection name containing
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. Rate
MongoDB C Driver bson_validate function returns early on specific inputs and incorrectly reports successful validation,
A mongoc_bulk_operation_t may read invalid memory if large options are passed. Rated medium severity (CVSS 6.9), this vu
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today