CVE-2024-21170
Medium · 6.3CVSS
6.3
EPSS
0.4%
Published
Jul 16, 2024
CISA due date
—
Cloudanix analysis
A bug in database connection software lets attackers with basic access change or see some data and slow things down a bit.
- Exploitation
- Remote Authenticated
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Data Tampering
- Component
- Library
- Class
- Authorization Bypass
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Authorization bypass in Connector/Python allows a low-privileged network attacker to perform unauthorized data modifications, limited reads, and partial denial of service against the connector's accessible data and functionality.
Why it matters to the business
Attackers can alter or delete limited database-related data, view restricted information, and cause partial service disruption, leading to data integrity issues, compliance risks, and operational downtime for organizations relying on MySQL Python connectors.
How an attack unfolds
An attacker with valid low-privileged network credentials connects via supported protocols and sends specially crafted requests that exploit the authorization flaw, bypassing intended access controls to modify, read, or disrupt connector-handled data and operations.
How to fix it
Upgrade Connector/Python to the latest patched version provided by Oracle that addresses this issue; apply vendor security updates promptly and restrict network access to the connector where possible.
How to confirm the fix worked
Confirm the installed Connector/Python version is newer than 8.4.0, review release notes for the fix, and test that low-privileged connections no longer allow the previously permitted unauthorized operations.
Typical attack path
- Obtain low-privileged network access to the MySQL Connector/Python service
- Establish a connection using one of the supported protocols
- Send crafted requests that trigger the authorization bypass
- Perform unauthorized insert/update/delete, read, or partial DoS actions
How to detect it
Review connector access logs for unexpected data changes or partial service failures from low-privileged sessions; correlate with authentication events to identify anomalous authorization bypass attempts.
What your security team should do
- Prioritize patching Connector/Python instances to the latest fixed release
- Limit network exposure of connector endpoints to trusted sources only
- Monitor for anomalous data modification or partial service impact patterns in connector logs
The record
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 8.4.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Ubuntu:16.04:LTS | mysql-connector-python | 0 | No fix |
| Ubuntu:18.04:LTS | mysql-connector-python | 0 | No fix |
| Ubuntu:20.04:LTS | mysql-connector-python | 0 | No fix |
| Ubuntu:22.04:LTS | mysql-connector-python | 0 | No fix |
| Ubuntu:24.04:LTS | mysql-connector-python | 0 | No fix |
| Ubuntu:24.10 | mysql-connector-python | 0 | No fix |
| Ubuntu:25.04 | mysql-connector-python | 0 | No fix |
| Ubuntu:25.10 | mysql-connector-python | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | mysql-connector-python | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | mysql-connector-python | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | mysql-connector-python | 0 | No fix |