VULNERABILITY INTELLIGENCE

CVE-2021-20329

CVSS score6.8 MEDIUM
EPSS probability0.94%
CISA KEVNot currently listed
Published2021-06-10
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.

Weakness classification

  • CWE-20: Improper Input Validation
  • CWE-1287: Improper Validation of Specified Type of Input

Primary references