CVE-2021-20331: MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver 2.12 <= 2.12.1.
Other sources
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-20331?
CVE-2021-20331 is a vulnerability in specific versions of the MongoDB C# Driver that may erroneously publish events containing authentication-related data to a command listener configured by an application.
How does CVE-2021-20331 affect MongoDB C# Driver?
CVE-2021-20331 affects specific versions of the MongoDB C# Driver by potentially exposing security-sensitive data in published events related to authentication.
What is the severity of CVE-2021-20331?
CVE-2021-20331 has a severity rating of 4.9 (medium).
How can I fix CVE-2021-20331?
To fix CVE-2021-20331, update your MongoDB C# Driver to a version that is not affected by the vulnerability.
Where can I find more information about CVE-2021-20331?
You can find more information about CVE-2021-20331 on the MongoDB Jira page: https://jira.mongodb.org/browse/CSHARP-3521