CVE-2019-14939 MySQL for Node.js Unsafe Options
The mysqljs library enables LOAD DATA LOCAL INFILE by default, allowing attackers to read arbitrary local files from the client system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14939?
CVE-2019-14939 is a medium-severity vulnerability in n/a, published on 12 Aug 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default.
Which versions are affected by CVE-2019-14939?
2 open source packages ship an affected version, including mysql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mysql npm | From 2.17.1 | 2.18.0 |
mysql npm | From 2.17.1 | 2.18.0 |
Products include Mysql Project Mysql.
How do I fix CVE-2019-14939?
Upgrade mysql to 2.18.0 or later.
Is CVE-2019-14939 being exploited?
There is no known exploitation of CVE-2019-14939 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2019-14939, GHSA-f982-mxwc-3mrx, UBUNTU-CVE-2019-14939.