CVE-2021-20327 | Date: (C)2021-02-27 (M)2024-02-22 |
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server���s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don���t use Field Level Encryption. This issue affect MongoDB Node.js Driver mongodb-client-encryption module version 1.2.0
CVSS Score and Metrics +CVSS Score and Metrics -CVSS V3 Severity: | CVSS V2 Severity: |
CVSS Score : 6.8 | CVSS Score : 4.3 |
Exploit Score: 1.6 | Exploit Score: 5.5 |
Impact Score: 5.2 | Impact Score: 4.9 |
|
CVSS V3 Metrics: | CVSS V2 Metrics: |
Attack Vector: ADJACENT_NETWORK | Access Vector: ADJACENT_NETWORK |
Attack Complexity: HIGH | Access Complexity: MEDIUM |
Privileges Required: NONE | Authentication: NONE |
User Interaction: NONE | Confidentiality: PARTIAL |
Scope: UNCHANGED | Integrity: PARTIAL |
Confidentiality: HIGH | Availability: NONE |
Integrity: HIGH | |
Availability: NONE | |
| |