PT-2024-6681 · Mongodb · Mongodb Rust Driver

Kevin Albertson · Published 2024-03-12 · Updated 2025-10-02 · CVE-2024-6382

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: MongoDB Rust Driver versions prior to 2.8.2

Description: The issue is related to incorrect handling of syntactically incorrect structures, which may result in the construction of unintended server commands. This could lead to unexpected application behavior, including data modification.

Recommendations: For MongoDB Rust Driver versions prior to 2.8.2, update to version 2.8.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-228

Related Identifiers

BDU:2024-07888

CVE-2024-6382

GHSA-32JF-H775-G29H

Affected Products

Mongodb Rust Driver

References · 14

• https://bdu.fstec.ru/vul/2024-07888 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6382 · Vendor Advisory
• https://jira.mongodb.org/browse/RUST-1881 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6382 · Security Note
• https://osv.dev/vulnerability/GHSA-32jf-h775-g29h · Vendor Advisory
• https://github.com/mongodb/mongo-rust-driver · Note
• https://github.com/mongodb/mongo-rust-driver/commit/a3fe6c84ce6287348b1268f651fdac9fbed66187 · Note
• https://github.com/mongodb/mongo-rust-driver/commit/8eac3bc6dc37a6d7667ed6c1a895c224e3ff47e1 · Note
• https://github.com/mongodb/mongo-rust-driver/pull/1045 · Note
• https://twitter.com/jksmaster2/status/1912518676772769954 · Twitter Post
• https://t.me/cveNotify/137172 · Telegram Post
• https://mongodb.com/resources/products/mongodb-security-bulletins · Note
• https://vuldb.com/?id.270259 · Note
• https://twitter.com/_Worty/status/1901705522035782027 · Twitter Post