VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 19 hours ago

CVE-2020-2934

5.0 Medium Out of RASP scope

Description

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.19 and prior and 5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.0 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L).

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 6 years.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 3.3% chance in 30 days

Waratek Defense Posture

Out of RASP scope

A genuine Java vulnerability in a supported product that the agent cannot reach: a coverage gap, not an out-of-domain finding.

  • Protection none
  • Action not-needed none
  • Review human manual-review
  • Record active
Decided by manual classification : Manual classification of this CVE in the legacy dataset
Finding Manual classification marked OUT-OF-SCOPE but CVE matches known CPE products

CVSS

5.0 MEDIUM v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L 3 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 5.0 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L NVD Primary published
CVSS 3.0 5.0 MEDIUM CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L secalert_us@oracle.com Secondary
CVSS 2.0 5.1 no band published AV:N/AC:H/Au:N/C:P/I:P/A:P NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update January 2022 ↗ CPU 2022-Q1 Oracle Fusion Middleware / Datasource (MySQL Connector) (12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
Oracle Critical Patch Update April 2020 ↗ CPU 2020-Q2 Oracle MySQL / Connector/J (8.0.19 and prior, 5.1.48 and prior)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Fusion Middleware Datasource (MySQL Connector) 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
Oracle MySQL Connector/J 8.0.19 and prior, 5.1.48 and prior

🖥️ Product CPEs & Version Ranges

4 product(s) over 10 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd debian debian linux generic 8.0 · 9.0
nvd fedoraproject fedora generic 32 · 33
nvd oracle mysql connector\/j generic ≤ 5.1.48 · ≥ 8.0.0 and ≤ 8.0.19
nvd oracle weblogic server generic 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0

Manual classification context

A reviewer manually classified this CVE. The retained record includes the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** MYSQL PROTOCOL, NO AUTH REMOTE EXPLOIT, CONNECTOR/J, SQL, DATASOURCE (MYSQL CONNECTOR) **Products:** MYSQL-CONNECTOR-JAVA, MYSQL CONNECTORS, ORACLE MYSQL, ORACLE WEBLOGIC SERVER, ORACLE FUSION MIDDLEWARE

References

URLTags
https://lists.debian.org/debian-lts-announce/2020/06/msg00015.html Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QDR2WOUETBT76WAO5NNCCXSAM3AGG3D/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDKQVPFT4Z4SFPBH6YNFMJOXKS2YYKHA/
https://security.gentoo.org/glsa/202105-27 Third Party Advisory
https://www.debian.org/security/2020/dsa-4703 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory

Timeline

Published 2020-04-15 Last modified 2026-06-17
Published2020-04-15By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.