MongoDB C Driver information disclosure

Summaryinfo

A vulnerability was found in MongoDB C Driver, PHP Driver, Swift Driver, Node.js Driver and C++ Driver. It has been declared as problematic. Affected by this issue is some unknown functionality. The manipulation results in information disclosure. This vulnerability is reported as CVE-2021-32050. The attack requires a local approach. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in MongoDB C Driver, PHP Driver, Swift Driver, Node.js Driver and C++ Driver (Database Software). It has been classified as problematic. Affected is some unknown processing. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).

The weakness was disclosed 08/29/2023. The advisory is shared for download at jira.mongodb.org. This vulnerability is traded as CVE-2021-32050 since 05/05/2021. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability scanner Nessus provides a plugin with the ID 232213 (Linux Distros Unpatched Vulnerability : CVE-2021-32050), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (232213). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Database Software

Vendor

• MongoDB

Name

• C++ Driver
• C Driver
• Node.js Driver
• PHP Driver
• Swift Driver

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion