{"answers":{"affected":"2 open source packages ship an affected version, including MongoDB.Driver. It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-48282 in the wild and no public exploit code.","fix":"Upgrade MongoDB.Driver to 2.19.0 or later.","what":"CVE-2022-48282 is a medium-severity unsafe deserialization vulnerability in MongoDB .NET/C# Driver, published on 21 Feb 2023. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-48282 and fix it if it is affected.\n\nWhat it is: CVE-2022-48282 is a medium-severity unsafe deserialization vulnerability in MongoDB .NET/C# Driver, published on 21 Feb 2023. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-48282 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- MongoDB.Driver (NuGet): affected all versions; fixed in 2.19.0\n- MongoDB.Driver (NuGet): affected all versions; fixed in 2.19.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-48282/ (Markdown: https://insights.sbomify.com/CVE-2022-48282/index.md)","id":"CVE-2022-48282","markdown":"https://insights.sbomify.com/CVE-2022-48282/index.md","name":"CVE-2022-48282","record":{"aliases":["ECHO-1b69-da77-cf10","GHSA-7j9m-j397-g4wx"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"MongoDB .NET Driver","requires_auth":"high_privilege","summary":"A privileged user can execute arbitrary code via deserialization in C# applications using the MongoDB .NET Driver under specific non-default configurations.","user_interaction":"not_required","vuln_class":"deserialization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mongodb","cpe":[{"product":"c\\#_driver","vendor":"mongodb"}],"cvss":{"score":6.6,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"description":"Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0\n\nFollowing configuration must be true for the vulnerability to be applicable:  *  Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND\n  *  Application must be running on a Windows host using the full .NET Framework, not .NET Core AND\n  *  Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND\n  *  Malicious attacker must have unrestricted insert access to target database to add a _t discriminator.\"Following configuration must be true for the vulnerability to be applicable","ecosystems":["NuGet"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution","id":"CVE-2022-48282","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"NuGet","product":null,"products":[],"type":"deserialization","year":"2022"},"n_packages":2,"n_references":2,"next":{"headline":"Privilege escalation in HarmonyOS AILife Solution 6.0","id":"CVE-2022-48283"},"packages":[{"ecosystem":"NuGet","fixed":["2.19.0"],"introduced":["0"],"last_affected":[],"package":"MongoDB.Driver","purl":null,"source":"GHSA-7j9m-j397-g4wx"},{"ecosystem":"NuGet","fixed":["2.19.0"],"introduced":["0"],"last_affected":[],"package":"MongoDB.Driver","purl":"pkg:nuget/MongoDB.Driver","source":"GHSA-7j9m-j397-g4wx"}],"prev":{"headline":"Memory corruption in n/a","id":"CVE-2022-48281"},"products":["MongoDB .NET/C# Driver"],"published":"2023-02-21","related":[{"cvss_score":7.1,"headline":"Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver","id":"CVE-2026-88026","kev_date_added":null,"published":"2026-09-10"},{"cvss_score":7.1,"headline":"Connection-option injection via unescaped settings in the canonical MongoDB URL builder","id":"CVE-2026-81529","kev_date_added":null,"published":"2026-08-27"},{"cvss_score":6.9,"headline":"NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation","id":"CVE-2026-81527","kev_date_added":null,"published":"2026-08-27"},{"cvss_score":6.8,"headline":"KMS master key exposure via unredacted credential serialization in driver settings string","id":"CVE-2026-81530","kev_date_added":null,"published":"2026-08-27"},{"cvss_score":6.1,"headline":"GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver","id":"CVE-2026-88025","kev_date_added":null,"published":"2026-09-10"},{"cvss_score":5.3,"headline":"NoSQL injection via array replacement bypassing update shape validation in driver write path","id":"CVE-2026-81528","kev_date_added":null,"published":"2026-08-27"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-03-11","vendors":["MongoDB Inc"]},"summary":"A privileged user can execute arbitrary code via deserialization in C# applications using the MongoDB .NET Driver under specific non-default configurations.","url":"https://insights.sbomify.com/CVE-2022-48282/"}