Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1.
References
| Link | Resource |
|---|---|
| https://jira.mongodb.org/browse/CSHARP-3521 | Issue Tracking Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
16 Sep 2024, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1. |
23 Jan 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1. |
Information
Published : 2021-05-13 08:15
Updated : 2024-09-16 23:15
NVD link : CVE-2021-20331
Mitre link : CVE-2021-20331
CVE.ORG link : CVE-2021-20331
JSON object : View
Products Affected
mongodb
- c\#_driver
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor