CVE-2025-21520: Low severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 1.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21520?
CVE-2025-21520 is considered a difficult to exploit vulnerability that can be leveraged by highly privileged attackers.
Which versions of MySQL Server are affected by CVE-2025-21520?
CVE-2025-21520 affects MySQL Server versions 8.0.40 and prior, 8.4.3 and prior, and 9.1.0 and prior.
How do I fix CVE-2025-21520?
To fix CVE-2025-21520, upgrade to a version of MySQL Server that is not affected, such as any version later than 8.0.40, 8.4.3, or 9.1.0.
What components of MySQL Server are impacted by CVE-2025-21520?
CVE-2025-21520 specifically impacts the Server: Options component of MySQL Server.
Can CVE-2025-21520 be exploited remotely?
CVE-2025-21520 is difficult to exploit and requires the attacker to have high privileges and logon to the infrastructure where MySQL Server is running.