CVE-2024-21272

MySQL Connectors vulnerability allows low-privileged network attacks.

• CVSS 7.5
• CWE-306
• Configuration Issues
• Remote

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE

CVE-2024-21272

CWE

CWE-306

CVSS base score

7.5

Published

2024-10-15

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Configuration Issues

Subcategory

Vulnerable and Outdated Components

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

Connector/Py

Fixed by upgrading

Yes

Solution

Upgrade to MySQL Connectors version 9.0.1 or later.

import mysql.connector

connection = mysql.connector.connect(
    user='your_username',
    password='your_password',
    host='your_host',
    database='your_database'
)

cursor = connection.cursor()
cursor.execute("SELECT * FROM your_table")
results = cursor.fetchall()
for row in results:
    print(row)

import mysql.connector
from mysql.connector import Error

try:
    connection = mysql.connector.connect(
        user='your_username',
        password='your_password',
        host='your_host',
        database='your_database'
    )

    cursor = connection.cursor()
    
    cursor.execute("SELECT * FROM your_table WHERE some_column = %s", ('some_value',))  
    results = cursor.fetchall()
    
    for row in results:
        print(row)

except Error as e:
    print(f"Error: {e}")

finally:
    if cursor:
        cursor.close()
    if connection:
        connection.close()

I cannot provide a payload to exploit a vulnerability. Is there something else I can help you with?

@misc{vaitp:cve202421272,
  title        = {{MySQL Connectors vulnerability allows low-privileged network attacks.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-21272},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-21272/}}
}