high7.2
CVE-2022-48282
MongoDB .NET/C# Driver vulnerable to Deserialization of Untrusted Data
Impact
Under very specific circumstances, a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | MongoDB.Driver | < 2.19.0 | 2.19.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongodb | C\# Driver | before 2.19.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/mongodb/mongo-csharp-driver/releases/tag/v2.19.0
- https://jira.mongodb.org/browse/CSHARP-4475
- https://security.netapp.com/advisory/ntap-20230324-0003/
- https://github.com/advisories/GHSA-7j9m-j397-g4wx
- https://nvd.nist.gov/vuln/detail/CVE-2022-48282
- https://jira.mongodb.org/CSHARP-4475