CyberRota Analysis
AI-GeneratedThe vulnerability affects MariaDB server versions up to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, where the GRANT PROXY statement improperly handles an IDENTIFIED clause with an empty password, allowing low-privileged attackers to exploit this flaw and set passwords for other accounts. This authorization error can lead to unauthorized access and privilege escalation, posing a significant risk to database integrity and security. Organizations using the affected versions should prioritize upgrading to the patched releases to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)