« Volver al listado

CVE-2024-6382

Estado: AnalizadaAlta (7.5)—

Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mongodb — Rust Driver

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-6382",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6382",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-02T19:25:24.875879Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@mongodb.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@mongodb.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mongodb:rust-driver:2.0.0:alpha:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.0.0:alpha1:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.0.0:beta:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.0.0:beta1:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.0.0:beta2:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.0.0:beta3:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.0.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.0.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.0.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.1.0:beta:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.1.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.2.0:beta:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.2.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.2.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.2.2:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.2.3:beta:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.3.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.3.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.4.0:beta:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.4.0:beta2:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.4.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.5.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.6.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.6.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.7.0:beta:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.7.0:beta1:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.7.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.7.1:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.8.0:*:*:*:*:mongodb:*:*",
            "cpe:2.3:a:mongodb:rust-driver:2.8.1:*:*:*:*:mongodb:*:*"
          ],
          "vendor": "MongoDB Inc",
          "product": "MongoDB Rust Driver",
          "versions": [
            {
              "status": "affected",
              "version": "2.0",
              "lessThan": "2.8.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-07-02T18:15:04.337",
  "references": [
    {
      "url": "https://jira.mongodb.org/browse/RUST-1881",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cna@mongodb.com"
    },
    {
      "url": "https://jira.mongodb.org/browse/RUST-1881",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@mongodb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-228"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2"
    },
    {
      "lang": "es",
      "value": "El manejo incorrecto de ciertas entradas de cadenas puede provocar que el controlador MongoDB Rust cree comandos de servidor no deseados. Esto puede provocar un comportamiento inesperado de la aplicación, incluida la modificación de datos. Este problema afecta a las versiones MongoDB Rust Driver 2.0 anteriores a la 2.8.2"
    }
  ],
  "lastModified": "2026-06-17T08:17:54.047",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mongodb:rust_driver:*:*:*:*:*:mongodb:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A0DC731-594D-402E-BDF6-650A7A8FBC80",
              "versionEndExcluding": "2.8.2",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@mongodb.com"
}