CVE-2024-6382: Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mongodb/rust-driverto a version that resolves this vulnerability.Fixed in 2.8.2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6382?
CVE-2024-6382 has been classified as a moderate severity vulnerability.
How do I fix CVE-2024-6382?
To fix CVE-2024-6382, upgrade the MongoDB Rust Driver to version 2.8.2 or later.
What can happen if CVE-2024-6382 is exploited?
Exploitation of CVE-2024-6382 can lead to unintended server commands being constructed, resulting in unexpected application behavior and potential data modification.
Which versions of MongoDB Rust Driver are affected by CVE-2024-6382?
CVE-2024-6382 affects MongoDB Rust Driver versions prior to 2.8.2.
Is it safe to use MongoDB Rust Driver 2.0 versions after patching for CVE-2024-6382?
Yes, using MongoDB Rust Driver version 2.8.2 or later is safe as it addresses the vulnerability CVE-2024-6382.