CVE-2023-21971

🗓️ 18 Apr 2023 19:54:35Reported by oracleType

cve🔗 web.nvd.nist.gov👁 564 Views🌐 WEB

Vulnerability in Oracle MySQL Connector/J (CVE-2023-21971). Unauthorized access and DOS risk

Reporter	Title	Published	Views	Family All 34
GithubExploit	Exploit for CVE-2023-21971	8 Jun 202303:05	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities in Oracle MySQL Server	14 Dec 202318:33	–	ibm
Circl	CVE-2023-21971	19 Apr 202300:29	–	circl
CNNVD	Oracle MySQL 安全漏洞	18 Apr 202300:00	–	cnnvd
CNVD	Unspecified Vulnerability in Oracle MySQL Server (CNVD-2023-65518)	21 Apr 202300:00	–	cnvd
Cvelist	CVE-2023-21971	18 Apr 202319:54	–	cvelist
EUVD	EUVD-2023-26136	3 Oct 202520:07	–	euvd
FreeBSD	MySQL -- Multiple vulnerabilities	19 Apr 202300:00	–	freebsd
F5 Networks	K000134573: MySQL vulnerability CVE-2023-21971	11 May 202317:54	–	f5
Tenable Nessus	FreeBSD : MySQL -- Multiple vulnerabilities (f504a8d2-e105-11ed-85f6-84a93843eb75)	24 Apr 202300:00	–	nessus

NVD

Vulners

Node

oracle communications_cloud_native_core_binding_support_functionMatch22.4.0

oracle communications_cloud_native_core_binding_support_functionMatch23.1.0

oracle communications_cloud_native_core_policyMatch22.4.0

oracle communications_cloud_native_core_policyMatch23.1.0

oracle mysql_connectorsRange8.0.0–8.0.32

Node

netapp active_iq_unified_managerMatch-linux

netapp active_iq_unified_managerMatch-vmware_vsphere

netapp active_iq_unified_managerMatch-windows

netapp oncommand_insightMatch-

netapp snapcenterMatch-

[
  {
    "vendor": "Oracle Corporation",
    "product": "MySQL Connectors",
    "versions": [
      {
        "version": "8.0.32 and prior",
        "status": "affected"
      }
    ]
  }
]

Source	Link
oracle	www.oracle.com/security-alerts/cpuapr2023.html
security	www.security.netapp.com/advisory/ntap-20230427-0007/
security	www.security.netapp.com/advisory/ntap-20230427-0010/
oracle	www.oracle.com/security-alerts/cpujul2023.html

Parameter	Position	Path	Description	CWE
propertiesTransform	query param	jdbc:mysql://localhost/test?user=test&password=test&propertiesTransform=com.example.MyArbitraryClass	RCE via MySQL Connector/J propertiesTransform deserialization mechanism.

21 Nov 2024 07:44Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.3

EPSS0.00173

SSVC