PT-2019-4688 · Mysql Server · Mysql Server

Publicado 2019-08-11 · Atualizado 2022-05-24 · CVE-2019-14939

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mysql (mysqljs) module version 2.17.1

Description The issue exists due to insufficient input validation in the LOAD DATA LOCAL INFILE component of the mysql (mysqljs) module for Node.js. This could allow an attacker to gain unauthorized access to protected information. The LOAD DATA LOCAL INFILE option is open by default.

Recommendations For mysql (mysqljs) module version 2.17.1, consider disabling the LOAD DATA LOCAL INFILE option as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2020-01060

CVE-2019-14939

GHSA-F982-MXWC-3MRX

Produtos afetados

Mysql Server

Referências · 17

• https://github.com/mysqljs/mysql/issues/2257 · Nota
• https://github.com/mysqljs/mysql/commit/337e87ae5fcea3667864197c65dc758517fcde06 · Nota
• https://github.com/mysqljs/mysql/issues/2471 · Nota
• https://github.com/mysqljs/mysql · Nota
• https://osv.dev/vulnerability/GHSA-f982-mxwc-3mrx · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-14939 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-14939 · Aviso do Fabricante
• https://web.archive.org/web/20190812004403/https://github.com/mysqljs/mysql/issues/2257 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14939 · Aviso do Fabricante
• https://cxsecurity.com/cveshow/CVE-2019-14939 · Nota
• https://ubuntu.com/security/CVE-2019-14939 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14939 · Nota de Segurança
• https://bdu.fstec.ru/vul/2020-01060 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2019-14939 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14939 · Aviso do Fabricante