CVE-2020-15180
mariadb-10.3 - security update
9.0
CRITICAL
CVSS 3.1
EPSS 5.5%
Description
A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.
How to fix CVE-2020-15180
To remediate CVE-2020-15180, upgrade the affected package to a fixed version below.
- —upgrade to 10.3.25-r0 or later
Is CVE-2020-15180 being exploited?
Moderate — EPSS is 5.5%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (1)
- >= 10.1.0, < 10.3.25-r0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |