PT-2018-3902 · Oracle+1 · Mysql Server

CVE-2018-3084 · Publicado 2018-06-17 · Atualizado 2023-05-31

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 8.0.11 and prior

Description The issue is related to insufficient access control in the MySQL Server component, specifically in the Shell: Core / Client subcomponent. This allows an attacker with low privileges and logon to the infrastructure where MySQL Server executes to compromise the server. Successful attacks require human interaction from a person other than the attacker and can result in a partial denial of service (DOS) of MySQL Server. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions 8.0.11 and prior, update to a version later than 8.0.11 to resolve the issue. As a temporary workaround, consider restricting access to the MySQL Server component to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2023-03050

CVE-2018-3084

Produtos afetados

Mysql Server

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2018-3084 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-3084 · Aviso do Fabricante
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Aviso do Fabricante
• https://oracle.com/security-alerts/cpujul2018.html · Nota
• https://bdu.fstec.ru/vul/2023-03050 · Nota de Segurança
• http://securityfocus.com/bid/104788 · Nota
• http://securitytracker.com/id/1041294 · Nota
• https://security.netapp.com/advisory/ntap-20180726-0002 · Correção