Entity Framework Core Provider
Monthly
NoSQL injection in the MongoDB Entity Framework Core provider allows an authenticated, low-privileged attacker to cause unintended modification of fields in records the application is already bulk-updating, and in some cases to relocate values already held in a record into other fields of that same record. Exposure is limited to applications that place caller-supplied values into a bulk update expressed as a database expression without neutralizing them; simply using the provider is not sufficient, and the assessed impact is Low confidentiality and integrity with no availability effect. No public exploit code has been identified at time of analysis, the priority label is monitor, and the only reference currently available is the vendor Jira advisory EF-478.
NoSQL injection in the MongoDB Entity Framework Core provider allows an authenticated, low-privileged attacker to cause unintended modification of fields in records the application is already bulk-updating, and in some cases to relocate values already held in a record into other fields of that same record. Exposure is limited to applications that place caller-supplied values into a bulk update expressed as a database expression without neutralizing them; simply using the provider is not sufficient, and the assessed impact is Low confidentiality and integrity with no availability effect. No public exploit code has been identified at time of analysis, the priority label is monitor, and the only reference currently available is the vendor Jira advisory EF-478.