CVE-2024-6382
MongoDB Rust driver may issue unintended commands
6.4
MEDIUM
CVSS 3.1
EPSS 0.28%
Description
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2
How to fix CVE-2024-6382
To remediate CVE-2024-6382, upgrade the affected package to a fixed version below.
- —upgrade to 2.8.2 or later
Is CVE-2024-6382 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 2.0.0, < 2.8.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L |