PT-2018-3902 · Oracle+1 · Mysql Server

Published 2018-06-17 · Updated 2023-05-31 · CVE-2018-3084

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 8.0.11 and prior

Description The issue is related to insufficient access control in the MySQL Server component, specifically in the Shell: Core / Client subcomponent. This allows an attacker with low privileges and logon to the infrastructure where MySQL Server executes to compromise the server. Successful attacks require human interaction from a person other than the attacker and can result in a partial denial of service (DOS) of MySQL Server. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions 8.0.11 and prior, update to a version later than 8.0.11 to resolve the issue. As a temporary workaround, consider restricting access to the MySQL Server component to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2023-03050

CVE-2018-3084

Affected Products

Mysql Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2018-3084 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3084 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03050 · Security Note
• https://security.netapp.com/advisory/ntap-20180726-0002 · Patch
• https://oracle.com/security-alerts/cpujul2018.html · Note
• http://securityfocus.com/bid/104788 · Note
• http://securitytracker.com/id/1041294 · Note