5.5Media

CVE-2021-32039MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text

MongoDB Inc. MongoDB for VS Code; mongodb mongodb Publicada: 2022-01-20 17:50 (hace 4 años)

Descripción

Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension for VS Code including and prior to version 0.7.0

Debilidad (CWE): CWE-522

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
mongodb	mongodb	-
MongoDB Inc.	MongoDB for VS Code	MongoDB for VS Code – ≤ 0.7.0

Referencias y parches

Puntuación CVSS

5.5Media

Fuente: mongodb · CVSS 3.1

Vector de ataque: Local
Complejidad: Baja
Privilegios: Bajos
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Alto
Integridad: Ninguno
Disponibilidad: Ninguno

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS (probabilidad de explotación en 30 días)

0.28%

superior al 21 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2021-05-05
Publicada2022-01-20 17:50
Llegó a IP-DB2026-10-25 00:04
Última actualización2024-09-17 04:51

Asignada por (CNA): mongodb

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — MongoDB

6.5Media

CVE-2026-104005 hace 29 días

Incorrect authorization in MongoDB Server router for bulk writes to system namespaces

MongoDB MongoDB Server

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregatio…

6.5Media

CVE-2026-104004 hace 29 días

Collection validators using collation-accepting expressions can crash MongoDB Server on insert

MongoDB MongoDB Server

MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated user…

5.4Media

CVE-2026-103965 hace 29 días

Fixed values in MongoDB Server $bucket stage may be misread as field references

MongoDB MongoDB Server

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output tha…

6.5Media

CVE-2026-96299 hace 29 días

Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service

MongoDB MongoDB Server

6.5Media

CVE-2026-96297 hace 29 días

MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline

MongoDB MongoDB Server

Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no…

7.5Alta

CVE-2026-89099 hace 2 meses

Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption

MongoDB MongoDB Server

A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a …