PT-2024-7165 · Oracle · Mysql Connectors

Published 2024-10-15 · Updated 2026-05-21 · CVE-2024-21262

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions MySQL Connectors versions 9.0.0 and prior

Description The issue is related to the Connector/ODBC component of the MySQL Connectors product, which is part of the Oracle MySQL system. It is caused by inadequate authorization procedure due to incorrect input validation. This allows an unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks can result in unauthorized update, insert, or delete access to some of MySQL Connectors' accessible data and the ability to cause a partial denial of service (partial DOS) of MySQL Connectors.

Recommendations For versions 9.0.0 and prior, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Incorrect Authorization

RCE

Improper Authorization

Weakness Enumeration

CWE-863

CWE-20

CWE-285

Related Identifiers

BDU:2024-08502

CVE-2024-21262

Affected Products

Mysql Connectors

References · 12

• https://oracle.com/security-alerts/cpuoct2024.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08502 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-21262 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21262 · Security Note
• https://ubuntu.com/security/CVE-2024-21262 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-21262 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21262 · Vendor Advisory
• https://t.me/cvenotify/98987 · Telegram Post
• https://twitter.com/CVEnew/status/1846284323575451749 · Twitter Post
• https://security.netapp.com/advisory/ntap-20241025-0005 · Note
• https://t.me/cveNotify/164461 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB20241015212 · Note