CVE-2024-20994: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema)

Description

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

High

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.0% · higher than 62% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

MS

MySQL Server · Oracle Corporation

through 8.0.36; through 8.3.0 · source: vendor, NVD

AI

Active IQ Unified Manager · Netapp

All versions, or not specified · source: NVD

OI

Oncommand Insight · Netapp

All versions, or not specified · source: NVD

OW

Oncommand Workflow Automation · Netapp

All versions, or not specified · source: NVD

SN

Snapcenter · Netapp

All versions, or not specified · source: NVD