CVE-2019-2692

Vulnerability

Overview

CVE-2019-2692 is a vulnerability in the MySQL Connectors component of Oracle MySQL, specifically in Connector/J [1]. All versions up to and including 8.0.15 are affected [1]. The flaw is rated as difficult to exploit, requiring a high-privileged attacker with logon access to the infrastructure where the connector executes [1]. The CVSS 3.0 base score is 6.3, with impacts on confidentiality, integrity, and availability [1].

Attack

Vector and Prerequisites

Successful exploitation depends on human interaction from a person other than the attacker [1]. This means a high-privileged user must be tricked or coerced into performing an action that triggers the vulnerability while the attacker has local access to the system [1][2]. The attack complexity is high, and the attacker must already have high privileges on the local machine [1].

Impact

If successfully exploited, the vulnerability results in a complete takeover of MySQL Connectors [1]. An attacker could then potentially execute arbitrary code, manipulate database connections, or exfiltrate sensitive data transmitted through the connector [1][2]. The impact spans all three security pillars: confidentiality, integrity, and availability [1].

Mitigation

Oracle has addressed the vulnerability in MySQL Connector/J version 8.0.16 [2]. Users should upgrade to this version or later to mitigate the risk. No workarounds have been publicly documented, and as of the latest advisories, the flaw is not listed on the CISA Known Exploited Vulnerabilities catalog.

References

[1] NVD - CVE-2019-2692 [2] Snyk Vulnerability Database - SNYK-JAVA-MYSQL-174574