Compliance Impact

This vulnerability causes MongoDB server to log authentication parameters, including credentials, in server logs without redaction when connection health metric logging is enabled. This exposure of sensitive authentication data in logs can lead to unauthorized access or data breaches.

Such exposure of sensitive credentials in logs can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data, including secure handling and storage of authentication information.

Useful 0 Not Useful 0

Executive Summary

This vulnerability occurs in the MongoDB server where, during SASL authentication, authentication parameters including credentials may be logged to the server log.

When connection health metric logging is enabled, the full authentication parameters are written to the log without any redaction, potentially exposing sensitive information.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to sensitive authentication credentials being exposed in server logs.

If an attacker gains access to these logs, they could retrieve authentication details, potentially compromising the security of the MongoDB server and its data.

Useful 0 Not Useful 0