Update operator injection via single-element list rewriting in the update builder
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.13.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The MongoDB C# Driver's update-statement builder can be affected, allowing user-supplied input to be treated as update operators instead of literal data. An application user with ordinary read-write access could thereby alter or delete stored data in unintended ways, though the database service's confidentiality and availability are not directly impacted.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, without any special privilege beyond ordinary read-write application access, may cause stored data to be modified or removed in ways the application never intended. The result is unauthorized integrity impact on the affected application data; there is no direct loss of confidentiality or availability of the database service.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- MongoDB C# Driver
From 2.0.0 · fixed in 3.13.0