Skip to main content

Improper Encoding or Escaping of Output

CVE-2021-20333

Medium
5.3/10

Summary

Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This vulnerability affects the mongodb package version through 3.6.20, 3.7.0 through 4.0.21, 4.1.0 through 4.2.10, 4.3.0 through 4.4.1, and 4.5.0.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-116 - Improper Encoding or Escaping of Output

The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References

Advisory Timeline

  • Published