{"id":"CVE-2024-6382","state":"PUBLISHED","title":"Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.","description":"Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2","publishedAt":"2024-07-02T17:17:50.237Z","updatedAt":"2024-08-01T21:41:03.220Z","severity":{"score":6.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","source":"mongodb"},"assigner":"mongodb","products":["MongoDB Inc MongoDB Rust Driver"],"affected":[{"vendor":"MongoDB Inc","product":"MongoDB Rust Driver","defaultStatus":"unaffected","versions":[{"version":"2.0","status":"affected","lessThan":"2.8.2","versionType":"custom"}],"cpes":["cpe:2.3:a:mongodb:rust-driver:2.0.0:alpha:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.0:alpha1:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.0:beta:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.0:beta1:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.0:beta2:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.0:beta3:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.1:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.2:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.1.0:beta:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.1.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.2.0:beta:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.2.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.2.1:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.2.2:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.2.3:beta:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.3.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.3.1:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.4.0:beta:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.4.0:beta2:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.4.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.5.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.6.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.6.1:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.7.0:beta:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.7.0:beta1:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.7.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.7.1:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.8.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.8.1:*:*:*:*:mongodb:*:*"]}],"references":["https://jira.mongodb.org/browse/RUST-1881"],"weaknesses":["CWE-228"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/6xxx/CVE-2024-6382.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-6382","state":"PUBLISHED","datePublished":"2024-07-02T17:17:50.237Z","dateUpdated":"2024-08-01T21:41:03.220Z","assignerShortName":"mongodb","assignerOrgId":"a39b4221-9bd0-4244-95fc-f3e2e07f1deb","dateReserved":"2024-06-27T08:37:36.558Z"},"containers":{"cna":{"title":"Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.","descriptions":[{"lang":"en","value":"Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2"}],"affected":[{"vendor":"MongoDB Inc","product":"MongoDB Rust Driver","defaultStatus":"unaffected","versions":[{"version":"2.0","status":"affected","lessThan":"2.8.2","versionType":"custom"}],"cpes":["cpe:2.3:a:mongodb:rust-driver:2.0.0:alpha:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.0:alpha1:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.0:beta:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.0:beta1:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.0:beta2:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.0:beta3:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.1:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.0.2:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.1.0:beta:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.1.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.2.0:beta:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.2.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.2.1:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.2.2:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.2.3:beta:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.3.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.3.1:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.4.0:beta:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.4.0:beta2:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.4.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.5.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.6.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.6.1:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.7.0:beta:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.7.0:beta1:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.7.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.7.1:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.8.0:*:*:*:*:mongodb:*:*","cpe:2.3:a:mongodb:rust-driver:2.8.1:*:*:*:*:mongodb:*:*"]}],"references":[{"url":"https://jira.mongodb.org/browse/RUST-1881"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-228","description":"CWE-228: Improper Handling of Syntactically Invalid Structure","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"mongodb","orgId":"a39b4221-9bd0-4244-95fc-f3e2e07f1deb","dateUpdated":"2024-07-02T17:17:50.237Z"},"datePublic":"2024-07-02T17:17:00.000Z","source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-02T19:25:24.875879Z","id":"CVE-2024-6382","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-02T19:38:21.077Z"}},{"title":"CVE Program Container","references":[{"url":"https://jira.mongodb.org/browse/RUST-1881","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T21:41:03.220Z"}}]}}}