5 results · Clear filters · Feed
-
High 7.5
MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time…
-
High 7.5
BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections
When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client…
-
High 7.5
MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service
An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operation subsequen…
-
High 7.7
MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service
A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message…
-
High 8.0
MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output
In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write t…