Mongodb Entity Framework Core Provider
Monthly
Field level encryption can be silently disabled in applications built on the MongoDB Entity Framework Core Provider when the connection string places a database name there, causing sensitive fields to be stored or read without the intended protection. This affects only applications that rely on field level encryption to protect sensitive data; deployments not using FLE are unaffected. The attacker must already have read access to the MongoDB datastore, backups, or network traffic to benefit, and no public exploit identified at time of analysis. The CVE feed lists CVSS 6.8, while the independent assessment rates it as a conditional data-protection weakness (CWE-311), not a remote code-execution flaw.
Sensitive credential disclosure in the MongoDB Entity Framework Core Provider occurs when the application runs with DEBUG-level logging enabled or when a malformed MongoDB connection string is supplied, causing the provider to record the connection string - including any embedded passwords and AWS secret access keys, where used - into application logs. Realistic exploitation requires local access plus existing privileges sufficient to read those logs, and it is confined to non-default configurations; deployments that obtain credentials from IAM roles or secret managers rather than inline connection strings are largely unaffected. No public exploit has been identified at time of analysis, and this is a genuine but low-to-moderate priority information-disclosure flaw rather than an urgent one.
MongoDB EF Core silently drops TLS and schema-map (client-side field-level/queryable encryption field map) settings when an application configures encryption both through independent/application-level settings and through the provider's own encryption settings, causing fields that were meant to be encrypted to be persisted in the database as cleartext. Only .NET applications built on the MongoDB Entity Framework Core Provider that combine both encryption configuration paths are affected; deployments using a single path, or not using field encryption at all, are not affected. No public exploit identified at time of analysis - the flaw is a silent misconfiguration with no attacker interaction at write time, and actual disclosure additionally requires a party to gain read access to the underlying MongoDB data, backups, or logs (CWE-311, Missing Encryption of Sensitive Data).
Field level encryption can be silently disabled in applications built on the MongoDB Entity Framework Core Provider when the connection string places a database name there, causing sensitive fields to be stored or read without the intended protection. This affects only applications that rely on field level encryption to protect sensitive data; deployments not using FLE are unaffected. The attacker must already have read access to the MongoDB datastore, backups, or network traffic to benefit, and no public exploit identified at time of analysis. The CVE feed lists CVSS 6.8, while the independent assessment rates it as a conditional data-protection weakness (CWE-311), not a remote code-execution flaw.
Sensitive credential disclosure in the MongoDB Entity Framework Core Provider occurs when the application runs with DEBUG-level logging enabled or when a malformed MongoDB connection string is supplied, causing the provider to record the connection string - including any embedded passwords and AWS secret access keys, where used - into application logs. Realistic exploitation requires local access plus existing privileges sufficient to read those logs, and it is confined to non-default configurations; deployments that obtain credentials from IAM roles or secret managers rather than inline connection strings are largely unaffected. No public exploit has been identified at time of analysis, and this is a genuine but low-to-moderate priority information-disclosure flaw rather than an urgent one.
MongoDB EF Core silently drops TLS and schema-map (client-side field-level/queryable encryption field map) settings when an application configures encryption both through independent/application-level settings and through the provider's own encryption settings, causing fields that were meant to be encrypted to be persisted in the database as cleartext. Only .NET applications built on the MongoDB Entity Framework Core Provider that combine both encryption configuration paths are affected; deployments using a single path, or not using field encryption at all, are not affected. No public exploit identified at time of analysis - the flaw is a silent misconfiguration with no attacker interaction at write time, and actual disclosure additionally requires a party to gain read access to the underlying MongoDB data, backups, or logs (CWE-311, Missing Encryption of Sensitive Data).