CVE-2021-20331: mongodb inc mongodb c driver
Vulnerability summary
CVE-2021-20331 is a medium (CVSS 4.9) vulnerability in mongodb inc mongodb c driver. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.9% of scored vulnerabilities.
Timeline
- 13-05-2021PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1.
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA4.2MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:NDiffers
- OSV · NugetEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.62% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mongodb1 product
- c_driver≥ 2.12.0, < 2.12.2 | 2.11.0
Mongodb inc1 product
- mongodb c driver≥ 2.12, ≤ 2.12.1
NuGet1 product
- MongoDB.Driver≥ 2.11.0, < 2.12.2
3 vendors · 3 products
