GHSA-7j9m-j397-g4wx
MongoDB .NET/C# Driver vulnerable to Deserialization of Untrusted Data
At a glance
- Published
- Updated
- CVE
- CVE-2022-48282
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
Under very specific circumstances, a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0
Affected packages
| Package | Versions |
|---|---|
| NuGet · MongoDB.Driver | introduced 0, fixed 2.19.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-48282 ADVISORY
- https://github.com/mongodb/mongo-csharp-driver PACKAGE
- https://github.com/mongodb/mongo-csharp-driver/releases/tag/v2.19.0 WEB
- https://jira.mongodb.org/CSHARP-4475 WEB
- https://jira.mongodb.org/browse/CSHARP-4475 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |