C Driver
CVE-2023-0437
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.
AnalysisAI
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-835. When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop.25.0. Affected products include: Mongodb C Driver.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. Rated medium
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected mul
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underl
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress s
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthentica
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are
Silent data corruption in MongoDB C Driver's BSON JSON parsing component allows unauthenticated network attackers to cau
The legacy GridFS API in the MongoDB C Driver fails to validate file metadata fields retrieved from the database, enabli
Integer wraparound in the MongoDB C Driver BSON library's JSON parser allows an unauthenticated party supplying a suffic
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged atta
Namespace injection in MongoDB C Driver (libmongoc) allows any caller-controlled database or collection name containing
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today