Search for vulnerabilities
Vulnerability details: VCID-v1rb-pm4j-aaae
Vulnerability ID VCID-v1rb-pm4j-aaae
Aliases CVE-2021-20329
GHSA-f6mq-5m25-4r72
Summary Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-20 Improper Input Validation
CWE-1287 Improper Validation of Specified Type of Input
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20329.json
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.0013 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
epss 0.00536 https://api.first.org/data/v1/epss?cve=CVE-2021-20329
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1971033
cvssv3.1 6.8 https://github.com/mongodb/mongo-go-driver
generic_textual MODERATE https://github.com/mongodb/mongo-go-driver
cvssv3.1 6.8 https://github.com/mongodb/mongo-go-driver/commit/2aca31d5986a9e1c65a92264736de9fdc3b9b4ca
generic_textual MODERATE https://github.com/mongodb/mongo-go-driver/commit/2aca31d5986a9e1c65a92264736de9fdc3b9b4ca
cvssv3.1 6.8 https://github.com/mongodb/mongo-go-driver/pull/622
generic_textual MODERATE https://github.com/mongodb/mongo-go-driver/pull/622
cvssv3.1 6.8 https://github.com/mongodb/mongo-go-driver/releases/tag/v1.5.1
generic_textual MODERATE https://github.com/mongodb/mongo-go-driver/releases/tag/v1.5.1
cvssv3.1 6.8 https://jira.mongodb.org/browse/GODRIVER-1923
generic_textual MODERATE https://jira.mongodb.org/browse/GODRIVER-1923
cvssv2 4.0 https://nvd.nist.gov/vuln/detail/CVE-2021-20329
cvssv3 6.5 https://nvd.nist.gov/vuln/detail/CVE-2021-20329
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2021-20329
cvssv3.1 6.8 https://pkg.go.dev/vuln/GO-2021-0112
generic_textual MODERATE https://pkg.go.dev/vuln/GO-2021-0112
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20329.json
https://api.first.org/data/v1/epss?cve=CVE-2021-20329
https://github.com/mongodb/mongo-go-driver
https://github.com/mongodb/mongo-go-driver/commit/2aca31d5986a9e1c65a92264736de9fdc3b9b4ca
https://github.com/mongodb/mongo-go-driver/pull/622
https://github.com/mongodb/mongo-go-driver/releases/tag/v1.5.1
https://jira.mongodb.org/browse/GODRIVER-1923
https://pkg.go.dev/vuln/GO-2021-0112
1971033 https://bugzilla.redhat.com/show_bug.cgi?id=1971033
cpe:2.3:a:mongodb:go_driver:*:*:*:*:*:mongodb:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mongodb:go_driver:*:*:*:*:*:mongodb:*:*
CVE-2021-20329 https://nvd.nist.gov/vuln/detail/CVE-2021-20329
RHSA-2023:1326 https://access.redhat.com/errata/RHSA-2023:1326
RHSA-2023:1328 https://access.redhat.com/errata/RHSA-2023:1328
RHSA-2023:1392 https://access.redhat.com/errata/RHSA-2023:1392
RHSA-2023:1409 https://access.redhat.com/errata/RHSA-2023:1409
RHSA-2023:1504 https://access.redhat.com/errata/RHSA-2023:1504
RHSA-2023:1525 https://access.redhat.com/errata/RHSA-2023:1525
RHSA-2023:1656 https://access.redhat.com/errata/RHSA-2023:1656
RHSA-2023:3645 https://access.redhat.com/errata/RHSA-2023:3645
RHSA-2023:4730 https://access.redhat.com/errata/RHSA-2023:4730
RHSA-2023:5007 https://access.redhat.com/errata/RHSA-2023:5007
RHSA-2023:6817 https://access.redhat.com/errata/RHSA-2023:6817
RHSA-2024:0193 https://access.redhat.com/errata/RHSA-2024:0193
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20329.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/mongodb/mongo-go-driver
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/mongodb/mongo-go-driver/commit/2aca31d5986a9e1c65a92264736de9fdc3b9b4ca
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/mongodb/mongo-go-driver/pull/622
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/mongodb/mongo-go-driver/releases/tag/v1.5.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://jira.mongodb.org/browse/GODRIVER-1923
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20329
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20329
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20329
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://pkg.go.dev/vuln/GO-2021-0112
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.21439
EPSS Score 0.00050
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.