PT-2023-9537 · Oracle+1 · Mysql Server

Published

2023-12-07

·

Updated

2024-10-16

·

CVE-2024-21244

CVSS v3.1

2.2

Low

VectorAV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.4.2 and prior MySQL Server versions 9.0.1 and prior
Description The issue is related to insufficient protection of internal data due to incorrect input validation in the Server: Telemetry component of the MySQL Server system. This can allow a remote attacker to gain unauthorized access to protected information using the MySQL network protocol. The vulnerability is difficult to exploit and requires a high-privileged attacker with network access via multiple protocols to compromise the MySQL Server, potentially resulting in unauthorized read access to a subset of MySQL Server accessible data.
Recommendations For MySQL Server versions 8.4.2 and prior, update to a version later than 8.4.2 to resolve the issue. For MySQL Server versions 9.0.1 and prior, update to a version later than 9.0.1 to resolve the issue. As a temporary workaround, consider restricting network access to the MySQL Server to minimize the risk of exploitation.

Fix

RCE

Information Disclosure

Weakness Enumeration

CWE-20CWE-200

Related Identifiers

BDU:2024-08293
CVE-2024-21244

Affected Products

Mysql Server