PT-2023-9536 · Oracle+1 · Mysql Server
Publicado
2023-12-07
·
Atualizado
2024-10-16
·
CVE-2024-21243
CVSS v3.1
2.2
Baixa
| Vetor | AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
MySQL Server versions 8.4.2 and prior
MySQL Server versions 9.0.1 and prior
Description
The issue is related to insufficient protection of internal data due to incorrect input validation in the Server: Telemetry component of MySQL Server. This allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks can result in unauthorized read access to a subset of MySQL Server accessible data. The vulnerability can be exploited to cause a hang or frequently repeatable crash of MySQL Server.
Recommendations
For MySQL Server versions 8.4.2 and prior, update to a version that contains a fix for this issue.
For MySQL Server versions 9.0.1 and prior, update to a version that contains a fix for this issue.
As a temporary workaround, consider restricting access to the Server: Telemetry component until a patch is available.
Correção
RCE
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Mysql Server