GitHub Advisoryadvisory · PyPI

GHSA-hgjp-83m4-h4fj MySQL Connector/Python connector takeover vulnerability

HIGH Published 2024-10-15 Modified 2024-10-24 Official page ↗
Aliases
CVE-2024-21272
Ecosystem
PyPI
Packages
mysql-connector-python
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2024-10-24

Affected packages

• PyPI mysql-connector-python: < 9.1.0 → fixed in 9.1.0

Description

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Related

Alias · CVE (1)

  • CVE-2024-21272 Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References