Oracle MySQL Enterprise Monitor up to 3.0.25/3.1.2 Monitoring privilege escalation

Summaryinfo

A vulnerability, which was classified as critical, has been found in Oracle MySQL Enterprise Monitor up to 3.0.25/3.1.2. This impacts an unknown function of the component Monitoring. The manipulation leads to privilege escalation. This vulnerability is referenced as CVE-2016-3461. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Oracle MySQL Enterprise Monitor up to 3.0.25/3.1.2 (Database Software). This issue affects an unknown functionality of the component Monitoring. The manipulation with an unknown input leads to a privilege escalation vulnerability. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Unspecified vulnerability in the MySQL Enterprise Monitor component in Oracle MySQL 3.0.25 and earlier and 3.1.2 and earlier allows remote administrators to affect confidentiality, integrity, and availability via vectors related to Monitoring: Server.

The weakness was published 04/19/2016 as Oracle Critical Patch Update Advisory - April 2016 as confirmed advisory (Website). The advisory is shared at oracle.com. The identification of this vulnerability is CVE-2016-3461 since 03/17/2016. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation requires an enhanced level of successful authentication. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 90685 (MySQL Enterprise Monitor 3.0.x < 3.0.26 / 3.1.x < 3.1.2 Unspecified RCE), which helps to determine the existence of the flaw in a target environment. It is assigned to the family CGI abuses and running in the context r.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (90685). Similar entries are available at VDB-12776, VDB-78153, VDB-82623 and VDB-82615. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Database Software

Vendor

• Oracle

Name

• MySQL Enterprise Monitor

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.0.18
• 3.0.19
• 3.0.20
• 3.0.21
• 3.0.22
• 3.0.23
• 3.0.24
• 3.0.25
• 3.1.0
• 3.1.1
• 3.1.2

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion