VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 19 hours ago

CVE-2018-3066

3.3 Low Out of RASP scope

Description

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 3.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N).

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 8 years.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 1.9% chance in 30 days

Waratek Defense Posture

Out of RASP scope

A genuine Java vulnerability in a supported product that the agent cannot reach: a coverage gap, not an out-of-domain finding.

  • Protection none
  • Action not-needed none
  • Review human manual-review
  • Record active
Decided by manual classification : Manual classification of this CVE in the legacy dataset
Finding Manual classification marked OUT-OF-SCOPE but CVE matches known CPE products

CVSS

3.3 LOW v3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N 2 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 3.3 LOW CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N NVD Primary published
CVSS 2.0 4.9 no band published AV:N/AC:M/Au:S/C:P/I:P/A:N NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update July 2018 ↗ CPU 2018-Q3 Oracle MySQL / Server: Options (5.5.60 and prior, 5.6.40 and prior, 5.7.22 and prior)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle MySQL Server: Options 5.5.60 and prior, 5.6.40 and prior, 5.7.22 and prior

🖥️ Product CPEs & Version Ranges

11 product(s) over 21 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd canonical ubuntu linux generic 12.04 · 14.04 · 16.04 · 18.04
nvd debian debian linux generic 8.0 · 9.0
nvd mariadb mariadb generic ≥ 5.5.0 and ＜ 5.5.61 · ≥ 10.0.0 and ＜ 10.0.36 · ≥ 10.1.0 and ＜ 10.1.35 · ≥ 10.2.0 and ＜ 10.2.17 · ≥ 10.3.0 and ＜ 10.3.9
nvd netapp oncommand insight generic any version
nvd netapp oncommand workflow automation generic any version
nvd netapp snapcenter generic any version
nvd netapp storage automation store generic any version
nvd oracle mysql generic ≥ 5.5.0 and ≤ 5.5.60 · ≥ 5.6.0 and ≤ 5.6.40 · ≥ 5.7.0 and ≤ 5.7.22
nvd redhat enterprise linux desktop generic 7.0
nvd redhat enterprise linux server generic 7.0
nvd redhat enterprise linux workstation generic 7.0

Manual classification context

A reviewer manually classified this CVE. The retained record includes the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** MYSQL PROTOCOL, SERVER: OPTIONS **Products:** MYSQL, MYSQL SERVER, ORACLE MYSQL

References

URLTags
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/104766 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041294 Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:3655 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1258 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2327 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/08/msg00036.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00004.html Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20180726-0002/ Third Party Advisory
https://usn.ubuntu.com/3725-1/ Third Party Advisory

Timeline

Published 2018-07-18 Last modified 2026-06-17
Published2018-07-18By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.