CVE-2021-20329CWE-1287

Specific cstrings input may not be properly validated in the Go Driver

Medium · published June 10, 2021

CVSS v3.1
6.8
EPSS
1%
Percentile
60.4
In the wild
Unconfirmed
What it is

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00935 · 60.4th percentile
Weakness
CWE-1287 · Improper Validation of Specified Type of Input
Published
2021-06-10T16:30Z
EPSS history
Timeline
  • 10 JUN 16:30Z
    Specific cstrings input may not be properly validated in the Go Driver
    cvelistv5