5.5Mittel

CVE-2021-32039MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text

MongoDB Inc. MongoDB for VS Code; mongodb mongodb Veröffentlicht: 2022-01-20 17:50 (vor 4 Jahren)

Beschreibung

Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension for VS Code including and prior to version 0.7.0

Schwachstellentyp (CWE): CWE-522

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
mongodb	mongodb	-
MongoDB Inc.	MongoDB for VS Code	MongoDB for VS Code – ≤ 0.7.0

Referenzen und Patches

CVSS-Score

5.5Mittel

Quelle: mongodb · CVSS 3.1

Angriffsvektor: Lokal
Komplexität: Niedrig
Rechte erforderlich: Niedrig
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Keine
Verfügbarkeit: Keine

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.29%

höher als 22 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2021-05-05
Veröffentlicht2022-01-20 17:50
Bei IP-DB eingegangen2026-10-25 00:04
Zuletzt aktualisiert2024-09-17 04:51

Vergeben von (CNA): mongodb

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — MongoDB

4.3Mittel

CVE-2026-120819 vor 4 Tagen

Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator

MongoDB MongoDB Server

A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted da…

9.0Kritisch

CVE-2026-118383 vor 4 Tagen

Pre-authentication use-after-free in MongoDB Server replica set primary catch-up

MongoDB MongoDB Server

A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpec…

7.5Hoch

CVE-2026-120828 vor 4 Tagen

Memory exhaustion via abandoned far-future read-concern waiters in disaggregated storage

MongoDB MongoDB Server

A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these record…

6.5Mittel

CVE-2026-120826 vor 4 Tagen

Improper Authorization in MongoDB Server Sharded View Definition Handling Leads to Cross-Database Unauthorized Access

MongoDB MongoDB Server

An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checki…

6.5Mittel

CVE-2026-120825 vor 4 Tagen

Improper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection Access

MongoDB MongoDB Server

An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege e…

8.8Hoch

CVE-2026-120824 vor 4 Tagen

Post-authentication use-after-free in MongoDB Server time-series bucket validation

MongoDB MongoDB Server

A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directl…