CVE-2022-39404: Medium severity mysql vulnerability
Vulnerability in the MySQL Installer product of Oracle MySQL (component: Installer: General). Supported versions that are affected are 1.6.3 and prior. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Installer executes to compromise MySQL Installer. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Installer accessible data as well as unauthorized read access to a subset of MySQL Installer accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Installer. CVSS 3.1 Base Score 4.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running MySQL Installer version 1.6.3 or earlier are affected. Exploitation is limited to an attacker who has a low-privileged account and can log on to the infrastructure where MySQL Installer runs.
What conditions are required for exploitation?
The attacker needs local access with low privileges, and exploitation is difficult. It also requires human interaction by someone other than the attacker.
What could an attacker achieve after successful exploitation?
An attacker could obtain unauthorized read access to a subset of data accessible to MySQL Installer, modify some accessible data through update, insert, or delete actions, and cause a partial denial of service affecting MySQL Installer.
How can I determine whether my environment is affected?
Check the installed MySQL Installer version. Versions 1.6.3 and earlier are identified as affected.
What remediation is available?
A patch is available. Apply the available patch to affected MySQL Installer deployments.