What is CVE-2021-20332?

CVE-2021-20332 is a medium-severity vulnerability in Mongodb Rust_driver, classified under Information Disclosure. CVSS score: 4.2/10. Published 2021-08-02.

How severe is CVE-2021-20332?

Medium severity. CVSS v3 base score is 4.2 out of 10.

Is CVE-2021-20332 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Mongodb Rust_driver

CVE-2021-20332

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentiall…

Vulnerability class: Information Disclosure

EPSS: 0.003 (22.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N.

Affected products

Mongodb Rust_driver — versions 2.0.0
Mongodb Inc. Rust Driver — versions 2.0.0-alpha, 2.0.0-alpha1, 1.0.0

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

Artisan-Lab/Rust-memory-safety-bugs

References

cna@mongodb.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-20332?: CVE-2021-20332 is a medium-severity vulnerability in Mongodb Rust_driver, classified under Information Disclosure. CVSS score: 4.2/10. Published 2021-08-02.
How severe is CVE-2021-20332?: Medium severity. CVSS v3 base score is 4.2 out of 10.
Is CVE-2021-20332 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.