CVE-2020-2584

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Oracle Corporation	MySQL Server	5.7.28 and prior; 8.0.18 and prior

References

https://security.gentoo.org/glsa/202105-27Third Party Advisory
https://security.netapp.com/advisory/ntap-20200122-0002/Third Party Advisory
https://usn.ubuntu.com/4250-1/Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/202105-27Third Party Advisory
https://security.netapp.com/advisory/ntap-20200122-0002/Third Party Advisory
https://usn.ubuntu.com/4250-1/Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.htmlPatch, Vendor Advisory

Timeline

Published: Jan 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-258406.1Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The vulnerability could CVE-2020-258427.5The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files throu CVE-2020-258439.8NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole. Remote attackers c CVE-2020-258449.8The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loophole CVE-2020-258457.4Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malici CVE-2020-258467.4The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redir CVE-2020-258478.8This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed th CVE-2020-258489.8HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.CVE-2020-258498.8MailGates and MailAudit products contain Command Injection flaw, which can be used to inject and execute system commands from the cgi parame CVE-2020-25855.9Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). The supported version that is affected is Java SE: 8u231. Diffic CVE-2020-258507.5The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to downl CVE-2020-258537.5The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not va