CVE-2021-20328

mediumPriorität · verfolgen · 27EPSS 0.004 · 38. PerzentilCHEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.44% (38th) EPSS
CVSS 4.3 · medium
Is it mine?
38 products
Prüfe deine Angriffsfläche
Who says so?
7 sources
cnnvd · enisa_euvd · abb_psirt · cisa_csaf_ot

EPSS · bewertet 2026-10-27

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenRed Hat Integration 1redhat_csaf

    To apply this update just follow standard installation procedure https://access.redhat.com/documentation/en-us/red_hat_integration/2021.q1/html/installing_debezium_on_openshift/installing-debezium-connectors-debezium

    https://access.redhat.com/errata/RHSA-2021:0871
  • MitigationIIoT services with MongoDB 4.2 installed on ABB Ability Zenon /allabb_psirt

    ABB recommends the following mitigation measures: - Replace bundled MongoDB with a supported version if IIoT services are required: - Where IIoT functionality is required, the bundled MongoDB instance can be replaced with a supported and patched version through manual configuration. - The following zenon online help section explains the process of installing and using your own MongoDB database: zenHelpViewer - Uninstall IIoT Services wherever it’s not required: - If IIoT Services are not required, they can be removed using the Control panel uninstaller. This eliminates the dependency on MongoDB without affecting other zenon components. Refer to section “General security recommendations” for further advise on how to keep your system secure.

  • MitigationIIoT services with MongoDB 4.2 installed on ABB Ability Zenon /allcisa_csaf_ot

    ABB recommends the following mitigation measures: - Replace bundled MongoDB with a supported version if IIoT services are required: - Where IIoT functionality is required, the bundled MongoDB instance can be replaced with a supported and patched version through manual configuration. - The following zenon online help section explains the process of installing and using your own MongoDB database: zenHelpViewer - Uninstall IIoT Services wherever it’s not required: - If IIoT Services are not required, they can be removed using the Control panel uninstaller. This eliminates the dependency on MongoDB without affecting other zenon components. Refer to section “General security recommendations” for further advise on how to keep your system secure.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.8
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.04.3mediumAV:A/AC:M/Au:N/C:P/I:P/A:Nprimary · NVD / NIST USAusnutzbarkeit 5.5 · Auswirkung 4.9
v3.16.8mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USAusnutzbarkeit 1.6 · Auswirkung 5.2
v3.16.8mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:U/RC:Csecondary · CISA US
v3.16.4mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · ENISA EU
v3.16.4mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · cna@mongodb.comAusnutzbarkeit 1.2 · Auswirkung 5.2
v3.16.8mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV
v3.16.2mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.16.8mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:U/RC:Csecondary · ABB PSIRT
v3.16.4mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · Red Hat Product Security US
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-295USprimärCWE-295USCWE-295USCWE-295USCWE-295US
05

betroffene Produkte (38)

Betroffene Produkte und Versionsbereiche.

20 von 38 angezeigt
06

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

  • 9AKK108472A9037ABB AbilityTM zenon Security Risk Due to End-of-Life MongoDB Component2026-07-30csaf · abb_psirtCH

    ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.

  • RHSA-2021:0871Red Hat Security Advisory: Red Hat Integration Debezium 1.4.2 security update2021-03-16csaf · redhat_csafUS

    An update for Debezium MongoDB connector is now available for Red Hat Integration. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • GHSA-rghw-6px2-fgwcImproper Certificate Validation in MongoDB2022-05-24ghsa · osvUS

    Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

  • ICSA-26-218-01ABB Ability Zenon2026-07-30icsa · cisa_csaf_otUS

    ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.

07

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdabb_psirtcisa_csaf_otnvdredhat_csafosvNVDCVE.orgMITRE
veröffentlicht 2021-02-25geändert 2026-06-17
10

Referenzen (11)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan