A high-severity SQL injection vulnerability in Evergreen allows unauthenticated attackers to potentially compromise database integrity.

This is a SQL injection vulnerability (CWE-89) that permits an unauthenticated attacker to manipulate database queries. The vulnerability stems from improper neutralization of special elements used in an SQL command.

The vulnerability carries a CVSS score of 7.3, indicating a high risk of unauthorized data access or modification. Successful exploitation could lead to the exposure of sensitive institutional data, corruption of records, or significant service disruption, potentially violating data privacy regulations.

Immediate Action: Update to Evergreen versions 3.14.12, 3.15.12, 3.16.6, or 3.17-beta2 immediately to incorporate the necessary security patches.

Proactive Monitoring: Review database query logs for unusual syntax or patterns that deviate from standard application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection payloads.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of SQL injection, organizations running the affected versions of Evergreen must prioritize patching. Failure to remediate this vulnerability leaves the backend database exposed to unauthorized commands, posing a critical risk to the confidentiality and integrity of the system.