PT-2019-1334 · Oracle+1 · Mysql Server

Publicado 2019-01-15 · Atualizado 2023-05-31 · CVE-2019-2513

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Baixa

Vetor base

AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 8.0.13 and prior

Description The issue is related to insufficient access control in the MySQL Server component, specifically in the Shell subcomponent. It allows an attacker with low privileges and logon to the infrastructure where MySQL Server executes to compromise the server. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The impact of this issue can result in unauthorized read access to a subset of MySQL Server accessible data.

Recommendations For versions 8.0.13 and prior, update to a version later than 8.0.13 to resolve the issue. As a temporary workaround, consider restricting access to the MySQL Server component to minimize the risk of exploitation. Restrict network access via multiple protocols to the MySQL Server to reduce the risk of a high-privileged attacker causing a denial of service.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2019-00648

CVE-2019-2513

Produtos afetados

Mysql Server

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2019-2513 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-2513 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20190118-0002 · Nota
• https://bdu.fstec.ru/vul/2019-00648 · Nota de Segurança
• https://oracle.com/security-alerts/cpujan2019.html · Nota
• http://securityfocus.com/bid/106622 · Nota
• http://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Aviso do Fabricante
• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Nota
• https://securityfocus.com/bid/106622 · Nota