CVE-2025-21520

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21520

1.8 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.3 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

V

ulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 1.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N).

References
Link Resource
https://www.oracle.com/security-alerts/cpujan2025.html Vendor Advisory
https://security.netapp.com/advisory/ntap-20250131-0004/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
History

03 Nov 2025, 21:18

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250131-0004/ -

09 Apr 2025, 15:16

Type Values Removed Values Added
First Time Oracle mysql Cluster
Oracle
Oracle mysql Server
CPE cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
References () https://www.oracle.com/security-alerts/cpujan2025.html - () https://www.oracle.com/security-alerts/cpujan2025.html - Vendor Advisory

22 Jan 2025, 19:15

Type Values Removed Values Added
CWE CWE-732
Summary
  • (es) Vulnerabilidad en el producto MySQL Server de Oracle MySQL (componente: Server: Options). Las versiones compatibles afectadas son 8.0.40 y anteriores, 8.4.3 y anteriores y 9.1.0 y anteriores. Esta vulnerabilidad, que es difícil de explotar, permite que un atacante con privilegios elevados y que inicie sesión en la infraestructura donde se ejecuta MySQL Server pueda comprometer MySQL Server. Los ataques exitosos requieren la interacción humana de una persona distinta del atacante. Los ataques exitosos de esta vulnerabilidad pueden dar como resultado un acceso de lectura no autorizado a un subconjunto de datos accesibles de MySQL Server. Puntuación base CVSS 3.1 1.8 (impactos de confidencialidad). Vector CVSS: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N).

21 Jan 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-21 21:15

Updated : 2025-11-03 21:18

NVD link : CVE-2025-21520

Mitre link : CVE-2025-21520

CVE.ORG link : CVE-2025-21520

JSON object : View

Products Affected

oracle

CWE
CWE-732

Incorrect Permission Assignment for Critical Resource