PT-2020-4839 · Mysql Server+2 · Mysql Cluster+2

Published 2020-10-21 · Updated 2022-07-28 · CVE-2020-14853

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: MySQL Cluster versions 8.0.21 and prior

Description: The issue is related to insufficient input validation in the Cluster: NDBCluster Plugin component of the MySQL Cluster product. It allows a low-privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized update, insert, or delete access to some of MySQL Cluster's accessible data, as well as the ability to cause a partial denial of service (partial DOS) of MySQL Cluster.

Recommendations: For versions 8.0.21 and prior, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-05393

CVE-2020-14853

USN-4604-1

Affected Products

Linuxmint

Mysql Cluster

Ubuntu

References · 59

• https://ubuntu.com/security/CVE-2020-14867 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14829 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2020.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14790 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14852 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14853 · Vendor Advisory
• https://security.gentoo.org/glsa/202105-27 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14844 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05393 · Security Note
• https://ubuntu.com/security/CVE-2020-14888 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14793 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14846 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14830 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14777 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14878 · Vendor Advisory