CVE-2025-21540: Medium severity oracle mysql vulnerability
Last updated 30 January 2025
Other sources
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21540?
CVE-2025-21540 is classified as an easily exploitable vulnerability that affects various versions of MySQL Server.
How do I fix CVE-2025-21540?
To fix CVE-2025-21540, upgrade to MySQL Server version 8.0.41-2 or a later version.
Which versions of MySQL Server are affected by CVE-2025-21540?
CVE-2025-21540 affects MySQL Server versions 8.0.40 and prior, 8.4.3 and prior, and 9.1.0 and prior.
Can a low privileged attacker exploit CVE-2025-21540?
Yes, CVE-2025-21540 allows a low privileged attacker to exploit the vulnerability with network access.
Is there a patch available for CVE-2025-21540?
Yes, a patch is available in the form of MySQL Server version 8.0.41-2 which addresses CVE-2025-21540.