PT-2023-1182 · Oracle · Oracle Mysql Cluster

CVE-2023-21860 · Publicado 2023-01-17 · Atualizado 2024-09-17

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:A/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle MySQL Cluster versions 7.4.38 and prior Oracle MySQL Cluster versions 7.5.28 and prior Oracle MySQL Cluster versions 7.6.24 and prior Oracle MySQL Cluster versions 8.0.31 and prior

Description The issue is related to insufficient input validation in the Cluster: Internal Operations component of Oracle MySQL Cluster. It allows a high-privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker and can result in the takeover of MySQL Cluster.

Recommendations For versions 7.4.38 and prior, update to a version later than 7.4.38. For versions 7.5.28 and prior, update to a version later than 7.5.28. For versions 7.6.24 and prior, update to a version later than 7.6.24. For versions 8.0.31 and prior, update to a version later than 8.0.31.

Correção

Improper Access Control

RCE

Enumeração de Fraquezas

CWE-284

CWE-20

Identificadores relacionados

BDU:2023-00405

CVE-2023-21860

Produtos afetados

Oracle Mysql Cluster

Referências · 5

• https://bdu.fstec.ru/vul/2023-00405 · Nota de Segurança
• https://oracle.com/security-alerts/cpujan2023.html · Aviso do Fabricante
• https://t.me/cvenotify/42817 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-21860 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-21860 · Aviso do Fabricante