CVE-2021-32050mediumCWE-200

CVE-2021-32050: medium-severity vulnerability in MongoDB C Driver

Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application

Published · Updated

Follow this CVE+ Monitor C Driver+ Monitor PHP Driver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.2epss 0.6%
Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Affected products
MongoDB Inc · MongoDB C DriverMongoDB Inc · MongoDB C++ DriverMongoDB Inc · MongoDB Node.js DriverMongoDB Inc · MongoDB PHP DriverMongoDB Inc · MongoDB Swift Driver
Related CVEs — MongoDB C Driver

In the same product, most dangerous first.

CVE-2023-0437MEDIUMMongoDB client C Driver may infinitely loop when validating certain BSON input dataEPSS 1.1%CVE-2024-7553HIGHAccessing Untrusted Directory May Allow Local Privilege EscalationEPSS 0.3%CVE-2026-4359LOWHeap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated bufferEPSS 0.2%