CVE-2022-48282: Deserialization of Untrusted Data

February 21, 2023 (updated March 3, 2023)

Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0

References

github.com/advisories/GHSA-7j9m-j397-g4wx
github.com/mongodb/mongo-csharp-driver/releases/tag/v2.19.0
jira.mongodb.org/CSHARP-4475
jira.mongodb.org/browse/CSHARP-4475
nvd.nist.gov/vuln/detail/CVE-2022-48282

Code Behaviors & Features

Detect and mitigate CVE-2022-48282 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →