CVE-2020-15180

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-77

Affected software

Vendor	Product	Versions
n/a	mariadb	mariadb 10.1.47, mariadb 10.2.34, mariadb 10.3.25, mariadb 10.4.15, mariadb 10.5.6

References

https://bugzilla.redhat.com/show_bug.cgi?id=1894919Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00021.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202011-14Third Party Advisory
https://www.debian.org/security/2020/dsa-4776Third Party Advisory
https://www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1894919Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00021.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202011-14Third Party Advisory
https://www.debian.org/security/2020/dsa-4776Third Party Advisory
https://www.percona.com/blog/2020/10/30/cve-2020-15180-affects-percona-xtradb-cluster/Patch, Third Party Advisory

Timeline

Published: May 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-151819.8The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access CVE-2020-151829.6The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE). The vulnerability aff CVE-2020-151834.8SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting (XSS) which leads to Remote Code Execution (RCE) from a known vulnera CVE-2020-151842.7In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could CVE-2020-151852.7In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a r CVE-2020-151862.7In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characte CVE-2020-151874.7In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugi CVE-2020-151889.8SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to execute any arbitra CVE-2020-151897.2SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability CVE-2020-15197.8An elevation of privilege vulnerability exists when the Windows UPnP Device Host improperly handles memory. To exploit this vulnerability, a CVE-2020-151905.3In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean CVE-2020-151915.3In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to `dlpack.to_dlpack` the expected validations will caus