CVE Vulnerability

CVE-2021-32039

Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension for VS Code including and prior to version 0.7.0

2.1 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

5.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/mongodb-js/vscode/releases/tag/v0.8.0 Release Notes Third Party Advisory
https://jira.mongodb.org/browse/VSCODE-313 Issue Tracking Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:visual_studio_code:*:*
Information

Published : 2022-01-20 03:15

Updated : 2022-01-26 07:53

NVD link : CVE-2021-32039

Mitre link : CVE-2021-32039

Products Affected
No products.
CWE
CWE-522