CVE-2021-20328
Estado: ModificadaMedia (6.8)—
Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted.
Leer descripción completaMostrar menos
This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Puntuación base: 6.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.44%
- Percentil entre todas las CVEs puntuadas: 36
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-295
- CWE-295
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-20328",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2021-20328",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-02-13T16:48:15.681647Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "ADJACENT_NETWORK",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 4.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 5.5,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "cna@mongodb.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.4,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.2,
"exploitabilityScore": 1.2
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.8,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.2,
"exploitabilityScore": 1.6
}
]
},
"affected": [
{
"source": "cna@mongodb.com",
"affectedData": [
{
"vendor": "MongoDB Inc.",
"product": "mongo-java-driver",
"versions": [
{
"status": "affected",
"version": "3.11",
"versionType": "custom",
"lessThanOrEqual": "3.11.2"
},
{
"status": "affected",
"version": "3.12",
"versionType": "custom",
"lessThanOrEqual": "3.12.7"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "MongoDB Inc.",
"product": "mongodb-driver",
"versions": [
{
"status": "affected",
"version": "3.11",
"versionType": "custom",
"lessThanOrEqual": "3.11.2"
},
{
"status": "affected",
"version": "3.12",
"versionType": "custom",
"lessThanOrEqual": "3.12.7"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "MongoDB Inc.",
"product": "mongodb-driver-sync",
"versions": [
{
"status": "affected",
"version": "4.2.0"
},
{
"status": "affected",
"version": "3.11",
"versionType": "custom",
"lessThanOrEqual": "3.11.2"
},
{
"status": "affected",
"version": "3.12",
"versionType": "custom",
"lessThanOrEqual": "3.12.7"
},
{
"status": "affected",
"version": "4.0",
"versionType": "custom",
"lessThanOrEqual": "4.0.5"
},
{
"status": "affected",
"version": "4.1",
"versionType": "custom",
"lessThanOrEqual": "4.1.1"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "MongoDB Inc.",
"product": "mongodb-driver-legacy",
"versions": [
{
"status": "affected",
"version": "4.2.0"
},
{
"status": "affected",
"version": "3.11",
"versionType": "custom",
"lessThanOrEqual": "3.11.2"
},
{
"status": "affected",
"version": "3.12",
"versionType": "custom",
"lessThanOrEqual": "3.12.7"
},
{
"status": "affected",
"version": "4.0",
"versionType": "custom",
"lessThanOrEqual": "4.0.5"
},
{
"status": "affected",
"version": "4.1",
"versionType": "custom",
"lessThanOrEqual": "4.1.1"
}
],
"defaultStatus": "unaffected"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*"
],
"vendor": "mongodb",
"product": "java_driver",
"versions": [
{
"status": "affected",
"version": "3.11",
"versionType": "custom",
"lessThanOrEqual": "3.11.2"
},
{
"status": "affected",
"version": "3.12",
"versionType": "custom",
"lessThanOrEqual": "3.12.7"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2021-02-25T17:15:28.303",
"references": [
{
"url": "https://jira.mongodb.org/browse/JAVA-4017",
"tags": [
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"source": "cna@mongodb.com"
},
{
"url": "https://jira.mongodb.org/browse/JAVA-4017",
"tags": [
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "cna@mongodb.com",
"description": [
{
"lang": "en",
"value": "CWE-295"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-295"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption."
},
{
"lang": "es",
"value": "Las versiones específicas del controlador de Java que soportan el client-side field level encryption (CSFLE) presentan un fallo al realizar una comprobación correcta del nombre del host en el certificado del servidor KMS. Esta vulnerabilidad, en combinación con un ataque MITM activo en una posición de red privilegiada, podría resultar en una interceptación del tráfico entre el controlador de Java y el servicio KMS, haciendo que el cifrado a nivel de campo sea ineficaz. Este problema se detectó durante las pruebas internas y afecta a todas las versiones del controlador de Java que soportan CSFLE. Los controladores Java async, Scala y flujos reactivos no están afectados. Esta vulnerabilidad no afecta a las cargas de tráfico del controlador con servicios clave compatibles con CSFLE que se originan en aplicaciones que residen dentro de los tejidos de red de AWS, GCP y Azure debido a los controles de compensación en estos entornos. Este problema no afecta a las cargas de trabajo de los controladores que no usan Field Level Encryption"
}
],
"lastModified": "2026-06-17T03:33:40.913",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
"vulnerable": true,
"matchCriteriaId": "A7269E59-8D72-4459-92D0-C7B725ED290A",
"versionEndExcluding": "3.11.3",
"versionStartIncluding": "3.11.0"
},
{
"criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
"vulnerable": true,
"matchCriteriaId": "564EEC7B-9969-45F8-A358-8034DCEDCE5E",
"versionEndExcluding": "3.12.8",
"versionStartIncluding": "3.12.0"
},
{
"criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
"vulnerable": true,
"matchCriteriaId": "97F149A2-F169-40CB-974D-91C6AB2D49DD",
"versionEndExcluding": "4.0.6",
"versionStartIncluding": "4.0.0"
},
{
"criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
"vulnerable": true,
"matchCriteriaId": "B7E4EF7D-C0F9-4B91-B7FE-5295F91AA108",
"versionEndExcluding": "4.1.2",
"versionStartIncluding": "4.1.0"
},
{
"criteria": "cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*",
"vulnerable": true,
"matchCriteriaId": "482332D0-4581-459D-A187-063F5BDEA2FF",
"versionEndExcluding": "4.2.1",
"versionStartIncluding": "4.2.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DA5D8178-3D1D-4AFE-80A3-7B68BF24E420",
"versionEndExcluding": "1.13.3"
},
{
"criteria": "cpe:2.3:a:quarkus:quarkus:1.13.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9EEC47CA-B2E0-437D-B8BF-C0DA5713BFB1"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cna@mongodb.com"
}