Command injection

2012-12-0312:49:00

PRIOn knowledge base

www.prio-n.com

6.5 Medium

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

0.029 Low

EPSS

Percentile

90.6%

JSON

Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.

CPENameOperatorVersion
mariadbge5.5.0
mariadblt5.5.30
mariadbge10.0.0
mariadblt10.0.2
mysqlge5.1.0
mysqlle5.1.67
mysqlge5.5.0
mysqlle5.5.29
enterprise_linux_desktopeq6.0
enterprise_linux_euseq6.4

Name	Operator	Version
mariadb	ge	5.5.0
mariadb	lt	5.5.30
mariadb	ge	10.0.0
mariadb	lt	10.0.2
mysql	ge	5.1.0
mysql	le	5.1.67
mysql	ge	5.5.0
mysql	le	5.5.29
enterprise_linux_desktop	eq	6.0
enterprise_linux_eus	eq	6.4