PT-2019-1334 · Oracle+1 · Mysql Server

Published 2019-01-15 · Updated 2023-05-31 · CVE-2019-2513

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 8.0.13 and prior

Description The issue is related to insufficient access control in the MySQL Server component, specifically in the Shell subcomponent. It allows an attacker with low privileges and logon to the infrastructure where MySQL Server executes to compromise the server. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The impact of this issue can result in unauthorized read access to a subset of MySQL Server accessible data.

Recommendations For versions 8.0.13 and prior, update to a version later than 8.0.13 to resolve the issue. As a temporary workaround, consider restricting access to the MySQL Server component to minimize the risk of exploitation. Restrict network access via multiple protocols to the MySQL Server to reduce the risk of a high-privileged attacker causing a denial of service.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2019-00648

CVE-2019-2513

Affected Products

Mysql Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2019-2513 · Security Note
• https://osv.dev/vulnerability/CVE-2019-2513 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00648 · Security Note
• http://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20190118-0002 · Note
• https://oracle.com/security-alerts/cpujan2019.html · Note
• http://securityfocus.com/bid/106622 · Note
• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Note
• https://securityfocus.com/bid/106622 · Note