Skip to content
Fencer Intel
medium 6.4

CVE-2024-6382 json

Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.

published 2y ago modified 4mo ago also GHSA-32jf-h775-g29h , EUVD-2024-47489

cvss
6.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits
0
none known

Summary

Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2

Patch / fix

  • crates.io mongodb 2.8.2
  • MongoDB Inc MongoDB Rust Driver 2.8.2

Is CVE-2024-6382 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2y ago

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub 3.1 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
crates.io mongodb
>=2.0.0, <2.8.2
2.8.2

Affected products

  • MongoDB Inc MongoDB Rust Driver

Classification

Weakness
  • CWE-228 Improper Handling of Syntactically Invalid Structure

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.