PT-2022-3832 · Oracle · Mysql Shell For Vs Code

Published 2022-07-19 · Updated 2024-03-06 · CVE-2022-21555

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MySQL Shell for VS Code versions 1.1.8 and prior

Description The issue is related to insecure privilege management in the MySQL Shell for VS Code component. It allows an attacker to gain read, modify, or delete access to data. The vulnerability can be exploited by a high-privileged attacker with logon access to the infrastructure where MySQL Shell for VS Code is executed. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. Attacks can result in unauthorized update, insert, or delete access to some MySQL Shell for VS Code accessible data, as well as unauthorized read access to a subset of MySQL Shell for VS Code accessible data.

Recommendations For versions 1.1.8 and prior, update to a version that addresses the insecure privilege management issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2022-04631

BIT-MYSQL-SHELL-2022-21555

CVE-2022-21555

Affected Products

Mysql Shell For Vs Code

References · 5

• https://bdu.fstec.ru/vul/2022-04631 · Security Note
• https://oracle.com/security-alerts/cpujul2022.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mysql-shell-2022-21555 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21555 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21555 · Security Note