PT-2018-3365 · Oracle+7 · Mysql Server+6
Publicado
2018-04-23
·
Atualizado
2024-06-15
·
CVE-2018-2767
CVSS v2.0
3.5
Baixa
| Vetor | AV:N/AC:M/Au:S/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
MySQL Server versions 5.5.60 and prior
MySQL Server versions 5.6.40 and prior
MySQL Server versions 5.7.22 and prior
Description:
The issue is related to a lack of protection for service data in the MySQL Server component of Oracle MySQL, specifically in the Server:Security:Encryption subcomponent. This can allow an attacker to gain unauthorized access to confidential data. The vulnerability can be exploited by a low-privileged attacker with network access via multiple protocols, potentially resulting in unauthorized read access to a subset of MySQL Server accessible data.
Recommendations:
For MySQL Server version 5.5.60 and prior, update to a version later than 5.5.60 to resolve the issue.
For MySQL Server version 5.6.40 and prior, update to a version later than 5.6.40 to resolve the issue.
For MySQL Server version 5.7.22 and prior, update to a version later than 5.7.22 to resolve the issue.
As a temporary workaround, consider restricting network access to the MySQL Server to minimize the risk of exploitation.
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Mariadb Server
Mysql Server
Red Hat
Suse
Ubuntu