PT-2022-10063 · Mongodb · Mongodb Extension For Vs Code

Published 2022-01-20 · Updated 2024-09-17 · CVE-2021-32039

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MongoDB Extension for VS Code versions prior to 0.7.0

Description The issue allows users with appropriate file access to obtain unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials can be used by malicious attackers to perform unauthorized actions.

Recommendations For versions prior to 0.7.0, update to version 0.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the binary file that stores user credentials to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BIT-MONGODB-2021-32039

CVE-2021-32039

Affected Products

Mongodb Extension For Vs Code

References · 7

• https://jira.mongodb.org/browse/VSCODE-313 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mongodb-2021-32039 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32039 · Security Note
• https://github.com/mongodb-js/vscode/releases/tag/v0.8.0 · Note
• https://t.me/cibsecurity/35926 · Telegram Post
• https://t.me/cvenotify/68384 · Telegram Post