Information Exposure Affecting mongodb.driver package, versions [2.11.0, 2.12.2)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-MONGODBDRIVER-1292153
- published 13 May 2021
- disclosed 13 May 2021
- credit Unknown
Introduced: 13 May 2021
CVE-2021-20331 Open this link in a new tabHow to fix?
Upgrade MongoDB.Driver
to version 2.12.2 or higher.
Overview
MongoDB.Driver is an Official .NET driver for MongoDB.
Affected versions of this package are vulnerable to Information Exposure. MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as saslStart
, saslContinue
, isMaster
, createUser
, and updateUser
are executed.
Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file.
Note: This issue only arises if an application enables the command listener feature (this is not enabled by default).