The version of MariaDB installed on the remote host is prior to 10.4.7. It is, therefore, affected by the following vulnerabilities as referenced in the mdb-1047-rn advisory.

  - A vulnerability in the 'Server: Pluggable Auth'     subcomponent. This is an easily exploitable     vulnerability that allows a highly privileged attacker     with network access via multiple protocols to     compromise the MariaDB Server. Successful attacks     involving this vulnerability can result in the     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of the MariaDB Server.
    (CVE-2019-2737)

  - A vulnerability in the 'Server: Security: Privileges'     subcomponent. This is an easily exploitable     vulnerability that allows a highly privileged attacker,     who is able to logon to the infrastructure where the     MariaDB Server executes, to compromise the MariaDB     Server. Successful attacks involving this vulnerability     can result in the unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of     MariaDB Server as well as unauthorized update, insert     or delete access to some of the data accessible to the     MariaDB Server. (CVE-2019-2739)

  - A vulnerability in the 'Server: XML' subcomponent. This     is an easily exploitable vulnerability that allows a     low privileged attacker with network access via multiple     protocols to compromise a MariaDB Server.Successful     attacks involving this vulnerability can result in the     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of the MariaDB Server.
    (CVE-2019-2740)

  - A vulnerability in the InnoDB subcomponent of the     MariaDB Server. This is an easily exploitable     vulnerability that allows a highly privileged attacker     with network access via multiple protocols to compromise     a MariaDB Server. Successful attacks involving this     vulnerability can result in the unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of the MariaDB Server as well as unauthorized     update, insert or delete access to some of the data     accessible to the MariaDB Server. (CVE-2019-2758)

  - A vulnerability in the 'Server: Parser' subcomponent.
    This is an easily exploitable vulnerability that allows     a low privileged attacker with network access via     multiple protocols to compromise the MariaDB Server.
    Successful attacks involving this vulnerability can     result in the unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of the     MariaDB Server. (CVE-2019-2805)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

MariaDB 10.4.0 < 10.4.7 Multiple Vulnerabilities

medium Nessus Plugin ID 128878

Version 1.5

Version 1.4

Version 1.5 Dec 6, 2022, 2:54 AM Reference Plugin Feed: 202212060254
Version 1.4 Nov 5, 2022, 7:49 PM CVE Exploit attributes Plugin Feed: 202211051949