CVE-2023-22102 MySQL Connectors takeover vulnerability
An unauthenticated attacker can compromise MySQL Connectors via network access, potentially leading to takeover and impacting additional products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-22102?
CVE-2023-22102 is a high-severity vulnerability in Netapp Oncommand Insight, published on 17 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
Weakness: CWE-284
Which versions are affected by CVE-2023-22102?
4 open source packages ship an affected version, including com.mysql:mysql-connector-j and mysql:mysql-connector-java. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
com.mysql:mysql-connector-j Maven | All versions | 8.2.0 |
com.mysql:mysql-connector-j Maven | All versions | 8.2.0 |
mysql:mysql-connector-java Maven | All versions to 8.0.33 | None |
mysql:mysql-connector-java Maven | All versions to 8.0.33 | None |
Products include Netapp Oncommand Insight, Oracle Mysql Connector\/J.
How do I fix CVE-2023-22102?
Upgrade com.mysql:mysql-connector-j to 8.2.0 or later.
Is CVE-2023-22102 being exploited?
There is no known exploitation of CVE-2023-22102 in the wild and no public exploit code.
Other vulnerabilities in Netapp Oncommand Insight
- CVE-2017-5600 Hardcoded credentials in n/a
- CVE-2018-1258 Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass
- CVE-2020-5421 RFD Protection Bypass via jsessionid
- CVE-2022-38733 Auth bypass in OnCommand Insight
- CVE-2021-35583 Denial of service in MySQL Server
Sources
Also known as AZL-31573, GHSA-m6vm-37g8-gqvh, ROOT-APP-MAVEN-CVE-2023-22102, UBUNTU-CVE-2023-22102.