CVE-2025-30706 Privilege escalation in MySQL Connectors
A low-privileged attacker can compromise MySQL Connectors via network access, leading to full takeover of the connector component.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30706?
CVE-2025-30706 is a high-severity vulnerability in Oracle Corporation MySQL Connectors, published on 15 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Weakness: CWE-276
Which versions are affected by CVE-2025-30706?
It affects 1 product.
Linux distribution packages (4)
mysql-connector-java SUSE:Linux Enterprise Server 16.0 | All versions | 9.3.0-160000.1.1 |
mysql-connector-java SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 9.3.0-160000.1.1 |
mysql-connector-java openSUSE:Leap 16.0 | All versions | 9.3.0-160000.1.1 |
mysql-connector-java openSUSE:Tumbleweed | All versions | 9.3.0-1.1 |
Products include Oracle Mysql Connector\/J.
How do I fix CVE-2025-30706?
Apply the vendor's patch.
Is CVE-2025-30706 being exploited?
There is no known exploitation of CVE-2025-30706 in the wild and no public exploit code.
Other vulnerabilities in Oracle Corporation MySQL Connectors
Sources
Also known as GHSA-mxpq-3mg3-vqx7, SUSE-SU-2025:21144-1, UBUNTU-CVE-2025-30706, openSUSE-SU-2025:15026-1, openSUSE-SU-2025:20089-1.