Critical severity9.0NVD Advisory· Published May 27, 2021· Updated Jun 17, 2026

CVE-2020-15180

Description

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in wsrep_sst_method allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Galeracluster/Galera Cluster For Mysql
cpe:2.3:a:galeracluster:galera_cluster_for_mysql:*:*:*:*:*:*:*:*
Range: >=5.6,<5.6.49
MariaDB/MariaDB3 versions
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*range: >=10.1.0,<10.1.47
- (no CPE)range: <10.1.47, <10.2.34, <10.3.25, <10.4.15, <10.5.6
- (no CPE)range: mariadb 10.1.47, mariadb 10.2.34, mariadb 10.3.25, mariadb 10.4.15, mariadb 10.5.6
Percona/Xtradb Cluster
cpe:2.3:a:percona:xtradb_cluster:*:*:*:*:*:*:*:*
Range: <5.6.49-28.42.2
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
osv-coords52 versions
pkg:bitnami/mariadb pkg:bitnami/mariadb-min pkg:bitnami/mysql-client pkg:rpm/almalinux/Judy pkg:rpm/opensuse/mariadb&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/mariadb&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/mariadb&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/mariadb-connector-c&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/mariadb-connector-c&distro=openSUSE%20Leap%2015.2 pkg:rpm/suse/lz4&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/lz4&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/lz4&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/mariadb&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/mariadb&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/mariadb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP1 pkg:rpm/suse/mariadb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP2 pkg:rpm/suse/mariadb&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS pkg:rpm/suse/mariadb&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/mariadb&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/mariadb&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/mariadb&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/mariadb&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/mariadb&distro=SUSE%20OpenStack%20Cloud%207 pkg:rpm/suse/mariadb&distro=SUSE%20OpenStack%20Cloud%209 pkg:rpm/suse/mariadb&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209 pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1 pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2 pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP1 pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP2 pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20OpenStack%20Cloud%209 pkg:rpm/suse/mariadb-connector-c&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209 pkg:rpm/suse/mariadb104&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/mariadb104&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/mariadb104&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/mariadb104&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/mariadb104&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/mariadb104&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/python-mysqlclient&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/python-mysqlclient&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/python-mysqlclient&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/python-mysqlclient&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/python-mysqlclient&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/python-mysqlclient&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5
>= 10.1.0, < 10.1.47+ 51 more
- (no CPE)range: >= 10.1.0, < 10.1.47
- (no CPE)range: >= 10.1.0, < 10.1.47
- (no CPE)range: >= 10.1.0, < 10.1.47
- (no CPE)range: < 1.0.5-18.module_el8.6.0+2867+72759d2f
- (no CPE)range: < 10.2.36-lp151.2.18.1
- (no CPE)range: < 10.4.17-lp152.2.8.1
- (no CPE)range: < 10.6.4-2.1
- (no CPE)range: < 3.1.11-lp151.3.15.1
- (no CPE)range: < 3.1.11-lp152.4.1
- (no CPE)range: < 1.8.0-3.5.2
- (no CPE)range: < 1.8.0-3.5.2
- (no CPE)range: < 1.8.0-3.5.2
- (no CPE)range: < 10.2.36-3.34.4
- (no CPE)range: < 10.2.36-3.34.4
- (no CPE)range: < 10.2.36-3.34.4
- (no CPE)range: < 10.4.17-3.6.1
- (no CPE)range: < 10.2.36-3.33.1
- (no CPE)range: < 10.2.36-3.33.1
- (no CPE)range: < 10.2.36-3.34.4
- (no CPE)range: < 10.2.36-3.33.1
- (no CPE)range: < 10.2.36-3.33.1
- (no CPE)range: < 10.2.36-3.34.4
- (no CPE)range: < 10.2.36-19.1
- (no CPE)range: < 10.2.36-3.33.1
- (no CPE)range: < 10.2.36-3.33.1
- (no CPE)range: < 3.1.11-3.22.2
- (no CPE)range: < 3.1.11-3.22.2
- (no CPE)range: < 3.1.11-3.22.2
- (no CPE)range: < 3.1.11-3.22.2
- (no CPE)range: < 3.1.11-3.22.2
- (no CPE)range: < 3.1.11-3.22.2
- (no CPE)range: < 3.1.11-2.19.1
- (no CPE)range: < 3.1.22-2.35.1
- (no CPE)range: < 3.1.11-3.22.2
- (no CPE)range: < 3.1.11-2.19.1
- (no CPE)range: < 3.1.22-2.35.1
- (no CPE)range: < 3.1.11-3.22.2
- (no CPE)range: < 3.1.22-2.35.1
- (no CPE)range: < 3.1.11-2.19.1
- (no CPE)range: < 3.1.11-2.19.1
- (no CPE)range: < 10.4.30-150100.3.5.10
- (no CPE)range: < 10.4.30-8.5.46
- (no CPE)range: < 10.4.30-150100.3.5.10
- (no CPE)range: < 10.4.30-8.5.46
- (no CPE)range: < 10.4.30-150100.3.5.10
- (no CPE)range: < 10.4.30-8.5.46
- (no CPE)range: < 1.4.6-150100.3.3.7
- (no CPE)range: < 1.3.14-8.9.2
- (no CPE)range: < 1.4.6-150100.3.3.7
- (no CPE)range: < 1.3.14-8.9.2
- (no CPE)range: < 1.4.6-150100.3.3.7
- (no CPE)range: < 1.3.14-8.9.2

Patches

Vulnerability mechanics

References

www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/nvdPatchThird Party Advisory
bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory
lists.debian.org/debian-lts-announce/2020/10/msg00021.htmlnvdMailing ListThird Party Advisory
security.gentoo.org/glsa/202011-14nvdThird Party Advisory
www.debian.org/security/2020/dsa-4776nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000