CVEvulnerability

CVE-2020-15180

9.0 CRITICAL Published 2021-05-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-05-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.0 CRITICAL — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20, CWE-77

Description

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

Affected configurations

• mariadb mariadb (>= 10.1.0 < 10.1.47) • mariadb mariadb (>= 10.2.0 < 10.2.34) • mariadb mariadb (>= 10.3.0 < 10.3.25) • mariadb mariadb (>= 10.4.0 < 10.4.15) • mariadb mariadb (>= 10.5.0 < 10.5.6) • debian debian linux 9.0 • debian debian linux 10.0 • percona xtradb cluster (< 5.6.49-28.42.2) • percona xtradb cluster (>= 5.7 < 5.7.31-31.45.2) • percona xtradb cluster (>= 8.0 < 8.0.20-11.2) • galeracluster galera cluster for mysql (>= 5.6 < 5.6.49) • galeracluster galera cluster for mysql (>= 5.7 < 5.7.31) • galeracluster galera cluster for mysql (>= 8.0 < 8.0.21)

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References