Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension for VS Code including and prior to version 0.7.0
References
| Link | Resource |
|---|---|
| https://github.com/mongodb-js/vscode/releases/tag/v0.8.0 | Release Notes Third Party Advisory |
| https://jira.mongodb.org/browse/VSCODE-313 | Issue Tracking Vendor Advisory |
Configurations
History
23 Jan 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension for VS Code including and prior to version 0.7.0 |
26 Jan 2022, 19:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/mongodb-js/vscode/releases/tag/v0.8.0 - Release Notes, Third Party Advisory | |
| References | (MISC) https://jira.mongodb.org/browse/VSCODE-313 - Issue Tracking, Vendor Advisory | |
| CWE | CWE-522 | |
| CPE | cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:visual_studio_code:*:* | |
| CVSS |
v2 : v3 : |
v2 : 2.1
v3 : 5.5 |
| First Time |
Mongodb
Mongodb mongodb |
24 Jan 2022, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Jan 2022, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-01-20 15:15
Updated : 2024-01-23 17:15
NVD link : CVE-2021-32039
Mitre link : CVE-2021-32039
CVE.ORG link : CVE-2021-32039
JSON object : View
Products Affected
mongodb
- mongodb
CWE
CWE-522
Insufficiently Protected Credentials