Privilege escalation affecting MariaDB
A vulnerability affecting MariaDB would allow an authenticated attacker to elevate privileges on affected systems.
Description
Technical context and vulnerability details
MariaDB is a relational database management system, derived from MySQL, designed to store and manage data within applications and IT infrastructures using the SQL language. This service is affected by a vulnerability resulting from insufficient control of access rights when executing privilege management commands. Exploitation of this vulnerability would allow a malicious actor, with a single user account, to submit specially crafted SQL queries to change the passwords of other users, including that of the administrative (root) account, and elevate their privileges on the affected system. This vulnerability is rated high with a severity score of 8.8.
Potential Risks & Impact
Potential consequences upon exploitation
- Unauthorized access to database;
- Privilege escalation;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- MariaDB version 12.3.2 and earlier;
- MariaDB development version 13.1.0 and earlier;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- review all accounts and change passwords;
- apply security patches provided by the publisher;
- update MariaDB to the latest stable versions available;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.