{"id":"CVE-2022-48282","aliases":["EUVD-2023-0657","GHSA-7j9m-j397-g4wx"],"status":"published","title":"Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution","description":"Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0\n\nFollowing configuration must be true for the vulnerability to be applicable:  *  Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND\n  *  Application must be running on a Windows host using the full .NET Framework, not .NET Core AND\n  *  Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND\n  *  Malicious attacker must have unrestricted insert access to target database to add a _t discriminator.\"Following configuration must be true for the vulnerability to be applicable","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01379,"percentile":0.72491,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2023-02-21T18:35:11Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"NuGet","package":"MongoDB.Driver","fixed_in":["2.19.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"MongoDB.Driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.0"}]}]},{"source":"osv","ecosystem":"NuGet","package":"MongoDB.Driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.0"}]}],"versions":["1.0.3744.30075","2.0.0","2.0.0-beta1","2.0.0-beta2","2.0.0-beta3","2.0.0-beta4","2.0.0-rc0","2.0.1","2.0.2","2.1.0","2.1.0-rc0","2.1.0-rc1","2.1.1","2.10.0","2.10.0-beta1","2.10.1","2.10.2","2.10.3","2.10.4","2.11.0","2.11.0-beta1","2.11.0-beta2","2.11.1","2.11.2","2.11.3","2.11.4","2.11.5","2.11.6","2.12.0","2.12.0-beta1","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.13.0","2.13.0-beta1","2.13.1","2.13.2","2.13.3","2.14.0","2.14.0-beta1","2.14.1","2.15.0","2.15.1","2.16.0","2.16.1","2.17.0","2.17.1","2.18.0","2.2.0","2.2.0-rc0","2.2.1","2.2.2","2.2.3","2.2.4","2.3.0","2.3.0-beta1","2.3.0-rc1","2.4.0","2.4.0-beta1","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.6.0","2.6.1","2.7.0","2.7.0-beta0001","2.7.1","2.7.2","2.7.3","2.8.0","2.8.1","2.9.0","2.9.0-beta1","2.9.0-beta2","2.9.1","2.9.2","2.9.3"]}],"products":[{"vendor":"mongodb","product":"c\\#_driver"},{"vendor":"mongodb inc","product":"mongodb .net/c# driver"}],"references":[{"url":"https://jira.mongodb.org/browse/CSHARP-4475","tags":["x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://github.com/mongodb/mongo-csharp-driver/releases/tag/v2.19.0","tags":["x_transferred","Release Notes","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230324-0003/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48282","tags":["advisory"]},{"url":"https://jira.mongodb.org/CSHARP-4475","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7j9m-j397-g4wx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48282.json","tags":["advisory"]},{"url":"https://github.com/mongodb/mongo-csharp-driver","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-48282","title":"Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution","description":"Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0\n\nFollowing configuration must be true for the vulnerability to be applicable:  *  Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND\n  *  Application must be running on a Windows host using the full .NET Framework, not .NET Core AND\n  *  Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND\n  *  Malicious attacker must have unrestricted insert access to target database to add a _t discriminator.\"Following configuration must be true for the vulnerability to be applicable\n\n\n\n","status":"published","published":"2023-02-21T18:35:11.643Z","modified":"2025-03-11T19:20:08.556Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:34:33.913527Z"}],"euvd":[{"id":"EUVD-2023-0657","description":"Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0\n\nFollowing configuration must be true for the vulnerability to be applicable:  *  Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND\n  *  Application must be running on a Windows host using the full .NET Framework, not .NET Core AND\n  *  Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND\n  *  Malicious attacker must have unrestricted insert access to target database to add a _t discriminator.\"Following configuration must be true for the vulnerability to be applicable\n\n\n\n","status":"published","published":"2023-02-21T18:35:11Z","modified":"2025-03-11T19:20:08Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T20:53:06.845495Z"}],"ghsa":[{"id":"GHSA-7j9m-j397-g4wx","title":"MongoDB .NET/C# Driver vulnerable to Deserialization of Untrusted Data","description":"Under very specific circumstances, a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0","status":"published","published":"2023-02-21T21:30:18Z","modified":"2023-03-03T22:58:42Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:36:46.526285Z"}],"nvd":[{"id":"CVE-2022-48282","description":"Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0\n\nFollowing configuration must be true for the vulnerability to be applicable:  *  Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND\n  *  Application must be running on a Windows host using the full .NET Framework, not .NET Core AND\n  *  Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND\n  *  Malicious attacker must have unrestricted insert access to target database to add a _t discriminator.\"Following configuration must be true for the vulnerability to be applicable\n\n\n\n","status":"published","published":"2023-02-21T19:15:10.827Z","modified":"2026-06-17T05:14:54.437Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:36.601381Z"}],"osv":[{"id":"CVE-2022-48282","title":"Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution","description":"Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0\n\nFollowing configuration must be true for the vulnerability to be applicable:  *  Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND\n  *  Application must be running on a Windows host using the full .NET Framework, not .NET Core AND\n  *  Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND\n  *  Malicious attacker must have unrestricted insert access to target database to add a _t discriminator.\"Following configuration must be true for the vulnerability to be applicable\n\n\n\n","status":"published","published":"2023-02-21T18:35:11.643Z","modified":"2026-10-28T02:30:45.198357683Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:44:27.776402Z"},{"id":"GHSA-7j9m-j397-g4wx","title":"MongoDB .NET/C# Driver vulnerable to Deserialization of Untrusted Data","description":"Under very specific circumstances, a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0","status":"published","published":"2023-02-21T21:30:18Z","modified":"2023-11-08T04:11:02.878311Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:41.002603Z"}]}}