Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2020-14828: MySQL Server Takeover via Network Attack
CVE-2020-14828 · published 6 years ago
Summary
A security flaw in MySQL Server versions 8.0.21 and earlier allows a malicious person with high privileges to take control of your MySQL Server from the network. This means they could potentially access sensitive data, make changes to your database, and disrupt your services. To protect yourself, update to a newer version of MySQL Server.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| oracle | mysql |
>= 8.0.0, <= 8.0.21 cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* |
| netapp | active_iq_unified_manager |
All versions
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* |
| netapp | oncommand_insight |
All versions
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* |
| netapp | oncommand_workflow_automation |
All versions
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* |
| netapp | snapcenter |
All versions
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* |
Original advisory text
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privilege...
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
References
- https://security.gentoo.org/glsa/202105-27 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20201023-0003/ Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Timeline
Published21 Oct 2020
Updated3 Nov 2026
First seen9 Jul 2026
Track software like this
Free during beta