The 9.0.0 versions of MySQL Connectors installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory.

  - Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++ (OpenSSL)).
    Supported versions that are affected are 9.0.0 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Connectors.  Vulnerability in the MySQL Connectors product of     Oracle MySQL (component: Connector/ODBC (OpenSSL)). Supported versions that are affected are 9.0.0 and     prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all MySQL Connectors accessible data and     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors.
    (CVE-2024-5535, CVE-2024-6119)

  - Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported     versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged     attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of     this vulnerability can result in takeover of MySQL Connectors. (CVE-2024-21272)

  - Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported     versions that are affected are 9.0.0 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors     accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL     Connectors. (CVE-2024-21262)

  - Security-in-Depth issue in the MySQL Connectors product of Oracle MySQL (component: Connector/C++ (zlib)).
    This vulnerability cannot be exploited in the context of this product.  Security-in-Depth issue in the     MySQL Connectors product of Oracle MySQL (component: Connector/ODBC (zlib)). This vulnerability cannot be     exploited in the context of this product. (CVE-2023-45853)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle MySQL Connectors (October 2024 CPU)

critical Nessus Plugin ID 209245

Version 1.3

Version 1.2

Version 1.3 Oct 18, 2024, 8:22 PM IAVM reference STIG Severity Plugin Feed: 202410182022
Version 1.2 Oct 18, 2024, 9:34 AM CVSS metrics ("CVSSv2 score" set to 10.0. "CVSSv3 score" set to 9.8. "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H". "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:O/RC:C") CVSSv2 score source (changed from "CVE-2024-5535" to "CVE-2023-45853") New Plugin Feed: 202410180934