Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0 Following configuration must be true for the vulnerability to be applicable: * Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND * Application must be running on a Windows host using the full .NET Framework, not .NET Core AND * Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND * Malicious attacker must have unrestricted insert access to target database to add a _t discriminator."Following configuration must be true for the vulnerability to be applicable

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Under very specific circumstances (see Required configuration section below), a privileged user is able to
    cause arbitrary code to be executed which may cause further disruption to services. This is specific to
    applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including
    v2.18.0 Following configuration must be true for the vulnerability to be applicable: * Application must
    written in C# taking arbitrary data from users and serializing data using _t without any validation AND *
    Application must be running on a Windows host using the full .NET Framework, not .NET Core AND *
    Application must have domain model class with a property/field explicitly of type System.Object or a
    collection of type System.Object (against MongoDB best practice) AND * Malicious attacker must have
    unrestricted insert access to target database to add a _t discriminator."Following configuration must be
    true for the vulnerability to be applicable (CVE-2022-48282)

ID	Name	Product	Family	Type	Severity
474017	Echo: MongoDB.Bson: security update to 2.13.0+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
474017	Echo: MongoDB.Bson: security update to 2.13.0+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
412109	SCA: security update for MongoDB.Driver (GHSA-7j9m-j397-g4wx)	Tenable Cloud Security	SCA Checks	Local	high
412109	SCA: security update for MongoDB.Driver (GHSA-7j9m-j397-g4wx)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2022-48282

high

Tenable Plugins

high

high

high

high