HIGHMaven →
org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
Affected packages
- org.mariadb:r2dbc-mariadb— before 1.4.1
Exploit signal
- Known exploited (CISA KEV)
- No
- EPSS score
- —
- EPSS percentile
- —
EPSS is the probability a CVE is exploited in the wild; percentile is its rank among all CVEs.
Sources
- https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-c857-9x2m-cvh2
- https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a
- https://hackerone.com/reports/3784556
- https://github.com/mariadb-corporation/mariadb-connector-r2dbc
- https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1
- https://jira.mariadb.org/browse/R2DBC-115
Structured record: https://osv.dev/vulnerability/GHSA-c857-9x2m-cvh2
Recommended response stack
Some links are affiliate links — HackTribune may earn a commission at no extra cost to you.
Get incidents like this as alerts for your stack.
Join the beta