CVE-2021-20333 — Improper Output Neutralization for Logs in INC Mongodb Server

CWE-117 — Improper Output Neutralization for Logs CWE-116 — Improper Encoding or Escaping of Output CWE-20 — Improper Input Validation5 documents5 sources

Severity

5.3MEDIUMNVD

EPSS

0.4%

top 40.80%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mongodb INC Mongodb Server Mongodb

Timeline

PublishedJul 23

Latest updateMay 24

Description

Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21 and MongoDB Server v4.2 versions prior to 4.2.10.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5mongodb_inc/mongodb_server3.6 — 3.6.20+2

▶NVDmongodb/mongodb3.6.0 — 3.6.20+2

Patches

Patch: jira.mongodb.org ↗Patch: jira.mongodb.org ↗

🔴Vulnerability Details

GHSA

GHSA-ghvr-mww9-3hrg: Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split↗2022-05-24

▶

OSV

CVE-2021-20333: Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split↗2021-07-23

▶

CVEList

Server log entry spoofing via newline injection↗2021-07-23

▶

📋Vendor Advisories

Red Hat

mongodb: server log entry spoofing via newline injection↗2020-08-28

▶