PT-2019-4688 · Mysql Server · Mysql Server

Published 2019-08-11 · Updated 2022-05-24 · CVE-2019-14939

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mysql (mysqljs) module version 2.17.1

Description The issue exists due to insufficient input validation in the LOAD DATA LOCAL INFILE component of the mysql (mysqljs) module for Node.js. This could allow an attacker to gain unauthorized access to protected information. The LOAD DATA LOCAL INFILE option is open by default.

Recommendations For mysql (mysqljs) module version 2.17.1, consider disabling the LOAD DATA LOCAL INFILE option as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-01060

CVE-2019-14939

GHSA-F982-MXWC-3MRX

Affected Products

Mysql Server

References · 17

• https://osv.dev/vulnerability/GHSA-f982-mxwc-3mrx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14939 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-14939 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14939 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14939 · Security Note
• https://bdu.fstec.ru/vul/2020-01060 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-14939 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14939 · Vendor Advisory
• https://github.com/mysqljs/mysql/issues/2257 · Note
• https://github.com/mysqljs/mysql/commit/337e87ae5fcea3667864197c65dc758517fcde06 · Note
• https://github.com/mysqljs/mysql/issues/2471 · Note
• https://github.com/mysqljs/mysql · Note
• https://web.archive.org/web/20190812004403/https://github.com/mysqljs/mysql/issues/2257 · Note
• https://cxsecurity.com/cveshow/CVE-2019-14939 · Note