CVE-2024-21209

A flaw was found in Oracle MySQL mysqldump. A high-privileged attacker on the network, with help from another user, can read a subset of data the MySQL client can access. Oracle rates it as difficult to exploit.

A low severity (CVSS 3.1 base score 2.0, vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) vulnerability was found in the mysqldump component of the Oracle MySQL Client. A high privileged attacker with network access via multiple protocols could exploit this flaw, but exploitation is difficult and successful attacks require human interaction from a person other than the attacker. A successful attack results in unauthorized read access to a subset of MySQL Client accessible data, with no impact on integrity or availability. Upstream lists MySQL Client 8.4.2 and prior and 9.0.1 and prior as affected. Of the Red Hat products, only Red Hat Enterprise Linux 10, which ships the mysql8.4 component, is affected, and a fix is being pursued through the delegated resolution process; the mysql 8.0 packages shipped in Red Hat Enterprise Linux 8 and 9, and the mysql package in Fedora, were evaluated and are not affected. The Red Hat severity rating of LOW is consistent with the upstream CVSS score.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.