CVE-2025-21540

Updated: 2025-11-10 00:37:44.6579

Description:

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x NONE 0.0
CVSS Version 3.x MEDIUM 5.4

Status

OS name Project name Version Score Severity Status Errata Last updated

Statement

AlmaLinux 9.2 ESU mysql 8.0.32 5.4 MEDIUM Released CLSA-2025:1741637440 2025-03-10 22:58:03
Alpine Linux 3.18 ELS mysql 10.11.11 5.4 MEDIUM Ignored 2025-09-10 21:08:27 Ignored due to low severity
CentOS 6 ELS mysql 5.1.73 5.4 MEDIUM Ignored 2025-04-18 03:52:26 Ignored due to low severity score
CentOS 8.4 ELS mysql 8.0.26 5.4 MEDIUM Released CLSA-2025:1740823577 2025-03-01 21:55:02
CentOS 8.5 ELS mysql 8.0.26 5.4 MEDIUM Released CLSA-2025:1740824456 2025-03-01 21:55:03
CentOS Stream 8 ELS mysql 8.0.26 5.4 MEDIUM Released CLSA-2025:1741074282 2025-03-04 21:54:18
CloudLinux 6 ELS mysql 5.1.73 5.4 MEDIUM Ignored 2025-04-18 03:52:27 Out of support scope
Oracle Linux 6 ELS mysql 5.1.73 5.4 MEDIUM Ignored 2025-04-18 03:52:26 Ignored due to low severity score
Ubuntu 20.04 ELS mysql 8.0.41 5.4 MEDIUM Ignored 2025-04-19 03:59:04 Ignored due to low severity