CVE-2021-20332

MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an application

State: Published
Severity: 4.2 Medium
Published: Aug 2, 2021
Updated: Sep 17, 2024
Reserved: Dec 17, 2020

Read the record on cve.org

Description

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credentials. Note that such monitoring is not enabled by default. This issue affects MongoDB Rust Driver version 2.0.0-alpha, MongoDB Rust Driver version 2.0.0-alpha1 and MongoDB Rust Driver version 1.0.0 through to and including 1.2.1

Scores

CVSS	Score	Vector	Source
3.1	4.2 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N	mongodb

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
MongoDB Rust DriverMongoDB Inc.	2.0.0-alphaAffected 2.0.0-alpha1Affected 1.0.0 through 1.2.1Affected

References

https://jira.mongodb.org/browse/RUST-591

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.