Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-3258

CVE-2018-3258: Improper Privilege Management in MySQL Connectors Java

8.8

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-3258
GHSA ID
GHSA-4vrv-ch96-6h42
EPSS Score
0.88714%
CWE
CWE-269
Published
5/13/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
mysql:mysql-connector-javamaven< 8.0.138.0.13

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from improper handling of asynchronous X Protocol messages when 'xdevapi.useAsyncProtocol' was enabled. Key indicators include:

  1. The default async protocol activation in PropertyDefinitions.java created an insecure code path
  2. AsyncMessageReader's message handling lifecycle (start->read->dispatch) lacked proper security validation
  3. TLS configuration in ExportControlled allowed weak ciphers when async was enabled
  4. The patch focused on hardening async message processing, adding validation layers, and disabling async by default These functions represent the core async message processing chain that would be active during exploitation when the vulnerable async protocol was enabled.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Vuln*r**ility in t** MySQL *onn**tors *ompon*nt o* Or**l* MySQL (su**ompon*nt: *onn**tor/J). Support** v*rsions t**t *r* *****t** *r* *.*.** *n* prior. **sily *xploit**l* vuln*r**ility *llows low privil**** *tt**k*r wit* n*twork ****ss vi* multipl* p

Reasoning

T** vuln*r**ility st*mm** *rom improp*r **n*lin* o* *syn**ronous X Proto*ol m*ss***s w**n 'x**v*pi.us**syn*Proto*ol' w*s *n**l**. K*y in*i**tors in*lu**: *. T** ****ult *syn* proto*ol **tiv*tion in Prop*rty***initions.j*v* *r**t** *n ins**ur* *o** p*