CVE-2021-32050: fallo de gravedad media en MongoDB C Driver
Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.2epss 0.6%
Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed.
Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default).
This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Productos afectados
MongoDB Inc · MongoDB C DriverMongoDB Inc · MongoDB C++ DriverMongoDB Inc · MongoDB Node.js DriverMongoDB Inc · MongoDB PHP DriverMongoDB Inc · MongoDB Swift DriverCVEs relacionadas — MongoDB C Driver
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-0437MEDIUMMongoDB client C Driver may infinitely loop when validating certain BSON input dataEPSS 1.1%CVE-2024-7553HIGHAccessing Untrusted Directory May Allow Local Privilege EscalationEPSS 0.3%CVE-2026-4359LOWHeap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated bufferEPSS 0.2%
Referencias
https://jira.mongodb.org/browse/CDRIVER-3797https://jira.mongodb.org/browse/CXX-2028https://jira.mongodb.org/browse/NODE-3356https://jira.mongodb.org/browse/PHPC-1869https://jira.mongodb.org/browse/SWIFT-1229https://lists.debian.org/debian-lts-announce/2025/05/msg00027.htmlhttps://security.netapp.com/advisory/ntap-20231006-0001/