PT-2023-6202 · Mysql Server · Mysql Installer

Tmotfl · Published 2023-10-17 · Updated 2023-10-24 · CVE-2023-22094

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions MySQL Installer versions prior to 1.6.8

Description The issue is related to insufficient input validation in the MySQL Installer product, specifically in the Installer: General component. This vulnerability can be easily exploited by a low-privileged attacker with logon access to the infrastructure where MySQL Installer executes, allowing them to compromise MySQL Installer. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The vulnerability can result in unauthorized creation, deletion, or modification access to critical data or all MySQL Installer accessible data, as well as the ability to cause a hang or frequently repeatable crash of MySQL Installer.

Recommendations For versions prior to 1.6.8, update to version 1.6.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the MySQL Installer to minimize the risk of exploitation. Avoid using the vulnerable component until the issue is resolved.

Fix

RCE

Improper Resource Release

Weakness Enumeration

CWE-20

CWE-404

Related Identifiers

BDU:2023-06911

CVE-2023-22094

Affected Products

Mysql Installer

References · 10

• https://osv.dev/vulnerability/CVE-2023-22094 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2023.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-22094 · Security Note
• https://ubuntu.com/security/CVE-2023-22094 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22094 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06911 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-22094 · Security Note
• https://vuldb.com/ru/?id.242760 · Note
• https://twitter.com/CVEnew/status/1714390728028143773 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB20231017101 · Note