CVE-2018-2813: Medium severity Oracle MySQL vulnerability
Last updated 18 August 2025
Other sources
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data.
External References:
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
— Red Hat
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-2813?
CVE-2018-2813 is classified as an easily exploitable vulnerability in MySQL Server that allows low privileged attackers to exploit the system.
How do I fix CVE-2018-2813?
To mitigate CVE-2018-2813, upgrade MySQL to versions 5.5.60, 5.6.40, or 5.7.22 or later, depending on your currently used version.
Which versions of MySQL are affected by CVE-2018-2813?
CVE-2018-2813 affects MySQL Server versions 5.5.59 and prior, 5.6.39 and prior, and 5.7.21 and prior.
Can CVE-2018-2813 affect MariaDB installations?
Yes, CVE-2018-2813 can affect certain versions of MariaDB if they are based on the affected MySQL versions.
What types of attacks are possible with CVE-2018-2813?
CVE-2018-2813 allows low privileged attackers with network access to execute arbitrary DDL commands, which can lead to unauthorized changes in the database.