WaratekVRT Sign in

CVE-2019-2532 Oracle MySQL

Affected softwareOracle MySQL
Severity4.9 Medium CVSS 3.1 2 scores
Published16 Jan 2019
Updated17 Jun 2026

Description

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 7 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 3.1% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

4.9 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 4.9 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H NVD Primary published
CVSS 2.0 4.0 none AV:N/AC:L/Au:S/C:N/I:N/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2019 ↗ CPU 2019-Q1 Oracle MySQL / Server: Security: Privileges (5.7.24 and prior, 8.0.13 and prior)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle MySQL Server: Security: Privileges 5.7.24 and prior, 8.0.13 and prior

Products and versions

11 products, 22 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 16.04 · 18.04 · 18.10
nvd netapp oncommand unified manager generic ≥ 7.3 · ≥ 9.4
nvd netapp oncommand workflow automation generic any version
nvd netapp snapcenter generic any version
nvd netapp storage automation store generic any version
nvd oracle mysql generic ≥ 5.7.0 and ≤ 5.7.24 · ≥ 8.0.0 and ≤ 8.0.13
nvd redhat enterprise linux generic 8.0
nvd redhat enterprise linux eus generic 8.1 · 8.2 · 8.4 · 8.6
nvd redhat enterprise linux server aus generic 8.2 · 8.4 · 8.6
nvd redhat enterprise linux server tus generic 8.2 · 8.4 · 8.6
nvd redhat software collections generic 1.0

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** MYSQL PROTOCOL, SERVER: SECURITY: PRIVILEGES **Products:** MYSQL, MYSQL SERVER, ORACLE MYSQL

References

URLTags
http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/106627 Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2484 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2511 Third Party Advisory
https://security.netapp.com/advisory/ntap-20190118-0002/ Third Party Advisory
https://usn.ubuntu.com/3867-1/ Third Party Advisory

Timeline
Published2019-01-16By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.