Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands. (MongoDB Inc MongoDB Rust Driver)
En bref
- Source
- NVD
- EPSS
- EPSS 0.28 % · centile 20 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mongodb
- Statut NVD
- Analyzed
Description
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2
Faiblesses (CWE)
- CWE-228 — Improper Handling of Syntactically Invalid Structure
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L | mongodb |
| CVSS 3.1 | MEDIUM 6.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L | NVD · cna@mongodb.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-47489
- GCVE · GCVE-0-2024-6382
Avis du CERT-FR
- CERTFR-2024-AVI-0537 — Multiples vulnérabilités dans MongoDB · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:mongodb:rust_driver:*:*:*:*:*:mongodb:*:*≥ 2.0.0 < 2.8.2
Produits affectés
| Produit | Versions |
|---|---|
| MongoDB Inc · MongoDB Rust Driver | affected 2.0 < 2.8.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |