CVE-2019-2502

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
Oracle Corporation	MySQL Server	8.0.13 and prior

References

http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/106625Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2484Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2511Third Party Advisory
https://security.netapp.com/advisory/ntap-20190118-0002/Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/106625Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2484Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2511Third Party Advisory
https://security.netapp.com/advisory/ntap-20190118-0002/Third Party Advisory

Timeline

Published: Jan 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-250207.5An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can retrieve the admini CVE-2019-250217.5An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access the OrientDB by provid CVE-2019-250229.8An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-event and injecting a pay CVE-2019-250236.5An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header (which can be manipulated client-side) is CVE-2019-250249.8OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_servic CVE-2019-250255.3The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time appr CVE-2019-250265.3Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting.CVE-2019-250276.1Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 throug CVE-2019-250286.1Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and CVE-2019-250299.8In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via CVE-2019-25036.4Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Connection Handling). Supported versions that are affecte CVE-2019-250305.5In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation functio