CVE-2021-20332: MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an application
Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credentials. Note that such monitoring is not enabled by default.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-20332?
CVE-2021-20332 is a vulnerability in specific versions of the MongoDB Rust Driver that can potentially leak credentials used for authentication.
What is the severity of CVE-2021-20332?
The severity of CVE-2021-20332 is medium with a CVSS score of 4.4.
How does CVE-2021-20332 affect MongoDB Rust Driver?
CVE-2021-20332 affects specific versions of the MongoDB Rust Driver by potentially leaking credentials used for authentication.
Which versions of the MongoDB Rust Driver are affected by CVE-2021-20332?
Versions 1.0.0 to 1.2.1, 2.0.0-alpha, and 2.0.0-alpha1 of the MongoDB Rust Driver are affected by CVE-2021-20332.
What is the CWE category of CVE-2021-20332?
CVE-2021-20332 falls under the CWE category 200 - Information Exposure.