PT-2021-6572 · Mongodb+1 · Mongodb Server+2

Sara Golemon + 1 · Published 2021-07-23 · Updated 2024-09-17 · CVE-2021-20333

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 3.6.20 MongoDB Server versions prior to 4.0.21 MongoDB Server versions prior to 4.2.10

Description The issue is related to a lack of output encoding or escaping in MongoDB, allowing a remote attacker to impact data integrity. Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split.

Recommendations For MongoDB Server versions prior to 3.6.20, update to version 3.6.20 or later. For MongoDB Server versions prior to 4.0.21, update to version 4.0.21 or later. For MongoDB Server versions prior to 4.2.10, update to version 4.2.10 or later.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

CWE-117

Related Identifiers

ALT-PU-2022-3039

BDU:2022-01838

BIT-MONGODB-2021-20333

CVE-2021-20333

Affected Products

Alt Linux

Mongodb Server

Mongodb

References · 14

• 🔥 https://jira.mongodb.org/browse/SERVER-50605 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20333 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-20333 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mongodb-2021-20333 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01838 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20333 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-20333 · Security Note
• https://ubuntu.com/security/CVE-2021-20333 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20333 · Note
• https://t.me/cvenotify/18045 · Telegram Post
• https://t.me/cibsecurity/26437 · Telegram Post
• https://t.me/cvenotify/68381 · Telegram Post
• https://t.me/cvenotify/94867 · Telegram Post