CVE-2021-20328

mediumpriority · track · 27EPSS 0.004 · 38 %ileCHEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.44% (38th) EPSS
CVSS 4.3 · medium
Is it mine?
38 products
Check your exposure
Who says so?
7 sources
cnnvd · enisa_euvd · abb_psirt · cisa_csaf_ot

EPSS · scored 2026-10-27

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedRed Hat Integration 1redhat_csaf

    To apply this update just follow standard installation procedure https://access.redhat.com/documentation/en-us/red_hat_integration/2021.q1/html/installing_debezium_on_openshift/installing-debezium-connectors-debezium

    https://access.redhat.com/errata/RHSA-2021:0871
  • MitigationIIoT services with MongoDB 4.2 installed on ABB Ability Zenon /allabb_psirt

    ABB recommends the following mitigation measures: - Replace bundled MongoDB with a supported version if IIoT services are required: - Where IIoT functionality is required, the bundled MongoDB instance can be replaced with a supported and patched version through manual configuration. - The following zenon online help section explains the process of installing and using your own MongoDB database: zenHelpViewer - Uninstall IIoT Services wherever it’s not required: - If IIoT Services are not required, they can be removed using the Control panel uninstaller. This eliminates the dependency on MongoDB without affecting other zenon components. Refer to section “General security recommendations” for further advise on how to keep your system secure.

  • MitigationIIoT services with MongoDB 4.2 installed on ABB Ability Zenon /allcisa_csaf_ot

    ABB recommends the following mitigation measures: - Replace bundled MongoDB with a supported version if IIoT services are required: - Where IIoT functionality is required, the bundled MongoDB instance can be replaced with a supported and patched version through manual configuration. - The following zenon online help section explains the process of installing and using your own MongoDB database: zenHelpViewer - Uninstall IIoT Services wherever it’s not required: - If IIoT Services are not required, they can be removed using the Control panel uninstaller. This eliminates the dependency on MongoDB without affecting other zenon components. Refer to section “General security recommendations” for further advise on how to keep your system secure.

02

cvss

Technical severity, 0–10. One row per scoring source.

6.8
010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.3mediumAV:A/AC:M/Au:N/C:P/I:P/A:Nprimary · NVD / NIST USexploitability 5.5 · impact 4.9
v3.16.8mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 1.6 · impact 5.2
v3.16.8mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:U/RC:Csecondary · CISA US
v3.16.4mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · ENISA EU
v3.16.4mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · cna@mongodb.comexploitability 1.2 · impact 5.2
v3.16.8mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV
v3.16.2mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.16.8mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:U/RC:Csecondary · ABB PSIRT
v3.16.4mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · Red Hat Product Security US
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-295USprimaryCWE-295USCWE-295USCWE-295USCWE-295US
05

affected products (38)

Products and version ranges known to be affected.

showing 20 of 38
06

advisories (4)

Vendor and ecosystem advisories describing this.

  • 9AKK108472A9037ABB AbilityTM zenon Security Risk Due to End-of-Life MongoDB Component2026-07-30csaf · abb_psirtCH

    ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.

  • RHSA-2021:0871Red Hat Security Advisory: Red Hat Integration Debezium 1.4.2 security update2021-03-16csaf · redhat_csafUS

    An update for Debezium MongoDB connector is now available for Red Hat Integration. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • GHSA-rghw-6px2-fgwcImproper Certificate Validation in MongoDB2022-05-24ghsa · osvUS

    Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

  • ICSA-26-218-01ABB Ability Zenon2026-07-30icsa · cisa_csaf_otUS

    ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdabb_psirtcisa_csaf_otnvdredhat_csafosvNVDCVE.orgMITRE
published 2021-02-25modified 2026-06-17
10

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan