A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.
oryginał ENCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XMongodb
APPMongodb7.0.0 – 7.0.35 (bez)8.0.0 – 8.0.24 (bez)8.2.0 – 8.2.10 (bez)8.3.0 – 8.3.3 (bez)
Powiązane podatności
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMe...
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by ...
A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON d...
A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod p...
When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" param...