CVE-2002-1921: High severity ORACLE MySQL vulnerability
The default configuration of MySQL 3.20.32 through 3.23.52, when running on Windows, does set the bind address to the loopback interface, which allows remote attackers to connect to the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
For MySQL 3.20.32 through 3.23.52 running on Windows, verify and configure the bind-address setting so it is bound to the loopback interface (i.e., ensure the server's bind-address is set to the loopback interface) to prevent remote connections.
MySQL (Windows) bind-address = loopback interface
Event History
Frequently Asked Questions
What is the severity of CVE-2002-1921?
CVE-2002-1921 is classified as a medium severity vulnerability.
How do I fix CVE-2002-1921?
To mitigate CVE-2002-1921, configure MySQL to bind only to the loopback interface.
What versions are affected by CVE-2002-1921?
CVE-2002-1921 affects MySQL versions 3.20.32 through 3.23.52 on Windows.
Can CVE-2002-1921 lead to unauthorized access?
Yes, CVE-2002-1921 allows remote attackers to connect to the MySQL database if not properly configured.
Is CVE-2002-1921 specific to any operating system?
CVE-2002-1921 specifically affects MySQL when running on Windows.