What is CVE-2021-20332?

CVE-2021-20332 is a medium-severity vulnerability in MongoDB Rust Driver, classified under Information Disclosure. CVSS score: 4.2/10. Published 2021-08-02.

How severe is CVE-2021-20332?

Medium severity. CVSS v3 base score is 4.2 out of 10.

Is CVE-2021-20332 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in MongoDB Rust Driver

CVE-2021-20332

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credentials. Note that such monitoring is not enabled by default. This issue affects MongoDB Rust Driver version 2.0.0-alpha, MongoDB Rust Driver version 2.0.0-alpha1 and MongoDB Rust Driver version 1.0.0 through to and including 1.2.1

Vulnerability class: Information Disclosure

EPSS: 0.003 (23.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N.

Affected products

Mongodb Rust_driver — versions 2.0.0
Mongodb Inc. Rust Driver — versions 2.0.0-alpha, 2.0.0-alpha1, 1.0.0

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

Artisan-Lab/Rust-memory-safety-bugs

References

cna@mongodb.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-20332?: CVE-2021-20332 is a medium-severity vulnerability in MongoDB Rust Driver, classified under Information Disclosure. CVSS score: 4.2/10. Published 2021-08-02.
How severe is CVE-2021-20332?: Medium severity. CVSS v3 base score is 4.2 out of 10.
Is CVE-2021-20332 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.