CVE-2025-50081
Description
From CVE.org
Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Client accessible data as well as unauthorized read access to a subset of MySQL Client accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N).
Statement
A low severity vulnerability was found in the mysqldump component of the Oracle MySQL Client. A high privileged remote attacker with network access via multiple protocols could exploit this flaw to gain unauthorized read, insert, update, or delete access to a subset of MySQL Client accessible data. Successful attacks are difficult to achieve and require human interaction from a person other than the attacker; availability is not impacted. The upstream affected version ranges are MySQL 8.0.0-8.0.42, 8.4.0-8.4.5, and 9.0.0-9.3.0. Red Hat Enterprise Linux 8, 9, and 10 ship affected MySQL packages (the mysql 8.0 and 8.4 module streams and the mysql8.4 component) and are recorded as affected, with fixes pursued through the delegated update process. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in its mysql packages. The Red Hat In-Vehicle OS mysql component is recorded as affected, although its delegated resolution is not affected. For Fedora, the community mysql8.0 and mysql8.4 packages are affected, but the fix has been deferred and tracked in rawhide only, so stable Fedora releases that carry the affected versions retain residual exposure to this low severity issue until updated packages become available. The Red Hat CVSS 3.1 base score of 3.1 (LOW) matches the upstream Oracle assessment.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.1 | N/A | 3.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | High | N/A | High |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
