Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: DD). Supported versions that are affected are 7.2.27 and earlier, 7.3.16 and earlier, 7.4.14 and earlier and 7.5.5 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.0 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).

The version of MySQL Cluster running on the remote host is 7.5.x prior to 7.5.6. It is, therefore, affected by an arbitrary data manipulation vulnerability in the DD subcomponent due to an unspecified flaw. An authenticated, remote attacker can exploit this to update, insert, or delete arbitrary data or cause a partial denial of service condition.

The version of MySQL Cluster running on the remote host is 7.4.x prior to 7.4.15. It is, therefore, affected by an arbitrary data manipulation vulnerability in the DD subcomponent due to an unspecified flaw. An authenticated, remote attacker can exploit this to update, insert, or delete arbitrary data or cause a partial denial of service condition.

The version of MySQL Cluster running on the remote host is 7.3.x prior to 7.3.17. It is, therefore, affected by an arbitrary data manipulation vulnerability in the DD subcomponent due to an unspecified flaw. An authenticated, remote attacker can exploit this to update, insert, or delete arbitrary data or cause a partial denial of service condition.

The version of MySQL Cluster running on the remote host is 7.2.x prior to 7.2.28. It is, therefore, affected by an arbitrary data manipulation vulnerability in the DD subcomponent due to an unspecified flaw. An authenticated, remote attacker can exploit this to update, insert, or delete arbitrary data or cause a partial denial of service condition.

ID	Name	Product	Family	Severity
99520	MySQL Cluster 7.5.x < 7.5.6 DD Subcomponent Arbitrary Data Manipulation (April 2017 CPU)	Nessus	Databases	medium
99519	MySQL Cluster 7.4.x < 7.4.15 DD Subcomponent Arbitrary Data Manipulation (April 2017 CPU)	Nessus	Databases	medium
99518	MySQL Cluster 7.3.x < 7.3.17 DD Subcomponent Arbitrary Data Manipulation (April 2017 CPU)	Nessus	Databases	medium
99517	MySQL Cluster 7.2.x < 7.2.28 DD Subcomponent Arbitrary Data Manipulation (April 2017 CPU)	Nessus	Databases	medium

Detections

Analytics

CVE-2017-3304

medium

Tenable Plugins

medium

medium

medium

medium