Description (CNA)
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| MongoDB / GO Driver | affected 2.1.0 before 2.8.2; affected 2.9.0 before 2.9.2 |
CWE
CWE-99
References
- https://jira.mongodb.org/browse/GODRIVER-4075
- https://pkg.go.dev/go.mongodb.org/mongo-driver/v2@v2.8.2
ADP enrichment
No English description supplied.
No references supplied.