Rust Driver
Monthly
Injection via unsanitized namespace identifiers in the MongoDB Rust Driver's Client::bulk_write operation allows an authenticated actor who can influence database or collection name arguments to redirect write operations to an unintended database within the same MongoDB deployment, using the application's own credentials. All versions of the mongodb crate prior to v3.8.2 are affected per vendor release notes; no public exploit or CISA KEV listing exists at time of analysis. The high integrity impact (VI:H in the CVSS 4.0 vector) reflects the potential for unauthorized modification of co-tenanted or privileged data across application-enforced logical boundaries.
NoSQL injection in the MongoDB Rust Driver's GridFS component allows an authenticated, low-privileged user to supply a crafted file identifier that is evaluated as a query predicate rather than a literal scalar value. Depending on the operation targeted, this can expose GridFS file content belonging to unintended records within the bucket, or - in the most destructive path - cause all file chunks in the affected bucket to be deleted, permanently rendering stored file content unreadable. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue is acknowledged by MongoDB via JIRA issue RUST-2469.
MongoDB Rust Driver releases prior to v3.2.5 treat the connection-string option tlsInsecure=False as if it were tlsInsecure=True, silently disabling TLS certificate validation exactly when an operator intended to require it. Because the inverted setting only takes effect when an application explicitly writes that non-default option, and because a successful attack additionally requires the adversary to occupy a man-in-the-middle position on the network path to the MongoDB server, real-world exploitability is substantially narrower than the raw network vector suggests; the primary impact is loss of confidentiality and integrity of data in transit through certificate spoofing. Exploitation status: no public exploit identified at time of analysis, and EPSS is low at 0.18% (7th percentile), consistent with the narrow configuration and interception prerequisites.
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Injection via unsanitized namespace identifiers in the MongoDB Rust Driver's Client::bulk_write operation allows an authenticated actor who can influence database or collection name arguments to redirect write operations to an unintended database within the same MongoDB deployment, using the application's own credentials. All versions of the mongodb crate prior to v3.8.2 are affected per vendor release notes; no public exploit or CISA KEV listing exists at time of analysis. The high integrity impact (VI:H in the CVSS 4.0 vector) reflects the potential for unauthorized modification of co-tenanted or privileged data across application-enforced logical boundaries.
NoSQL injection in the MongoDB Rust Driver's GridFS component allows an authenticated, low-privileged user to supply a crafted file identifier that is evaluated as a query predicate rather than a literal scalar value. Depending on the operation targeted, this can expose GridFS file content belonging to unintended records within the bucket, or - in the most destructive path - cause all file chunks in the affected bucket to be deleted, permanently rendering stored file content unreadable. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue is acknowledged by MongoDB via JIRA issue RUST-2469.
MongoDB Rust Driver releases prior to v3.2.5 treat the connection-string option tlsInsecure=False as if it were tlsInsecure=True, silently disabling TLS certificate validation exactly when an operator intended to require it. Because the inverted setting only takes effect when an application explicitly writes that non-default option, and because a successful attack additionally requires the adversary to occupy a man-in-the-middle position on the network path to the MongoDB server, real-world exploitability is substantially narrower than the raw network vector suggests; the primary impact is loss of confidentiality and integrity of data in transit through certificate spoofing. Exploitation status: no public exploit identified at time of analysis, and EPSS is low at 0.18% (7th percentile), consistent with the narrow configuration and interception prerequisites.
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.