CVE-2020-2694

LowCVSS 3.1/10Last modified Jun 17, 2026

Description

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.18 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Oracle Corporation	MySQL Server	8.0.18 and prior

References

https://security.gentoo.org/glsa/202105-27Third Party Advisory
https://security.netapp.com/advisory/ntap-20200122-0002/Third Party Advisory
https://usn.ubuntu.com/4250-1/Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/202105-27Third Party Advisory
https://security.netapp.com/advisory/ntap-20200122-0002/Third Party Advisory
https://usn.ubuntu.com/4250-1/Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.htmlPatch, Vendor Advisory

Timeline

Published: Jan 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-269415.5A local (authenticated) low-privileged user can exploit a behavior in an ESET installer to achieve arbitrary file overwrite (deletion) of an CVE-2020-269429.1An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a CVE-2020-269439.9An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horiz CVE-2020-269449.8An issue was discovered in Aptean Product Configurator 4.61.0000 on Windows. A Time based SQL injection affects the nameTxt parameter on the CVE-2020-269458.1MyBatis before 3.5.6 mishandles deserialization of object streams.CVE-2020-269477.8monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH (with a preference ahead of /usr/lib), which a CVE-2020-269489.8Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.CVE-2020-26955.3Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Approval Framework). Suppo CVE-2020-269508.8In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condi CVE-2020-269516.1A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker alre CVE-2020-269528.8Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash wh CVE-2020-269534.3It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phish