CVE-2020-2875
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported...
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.14 and prior and 5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.14 and prior and 5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Record
CVE-2020-2875- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
EUVDEUVD-2020-22668
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.14 and prior and 5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Record
EUVD-2020-22668- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cq4v-593f-gw93
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported...
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.14 and prior and 5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Record
GHSA-cq4v-593f-gw93- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
NVD
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.14 and prior and 5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Record
CVE-2020-2875- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-2875
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.14 and prior and 5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Record
UBUNTU-CVE-2020-2875- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1126-1 No score
Security update for mysql-connector-java
This update for mysql-connector-java fixes the following issues:
- CVE-2020-2875: Unauthenticated attacker with network access via multiple protocols can compromise MySQL Connectors. (bsc#1173600)
- CVE-2020-2934: Fixed a vulnerability which could cause a partial denial of service of MySQL Connectors. (bsc#1173600)
- CVE-2020-2933: Fixed a vulnerability which could allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. (bsc#1173600)
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:1126-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2622-1 No score
Security update for mysql-connector-java
This update for mysql-connector-java fixes the following issues:
- CVE-2020-2875: Unauthenticated attacker with network access via multiple protocols can compromise MySQL Connectors. (bsc#1173600)
- CVE-2020-2934: Fixed a vulnerability which could cause a partial denial of service of MySQL Connectors. (bsc#1173600)
- CVE-2020-2933: Fixed a vulnerability which could allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. (bsc#1173600)
- Record
openSUSE-SU-2021:2622-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11071-1 No score
mysql-connector-java-8.0.25-2.2 on GA media
These are all security issues fixed in the mysql-connector-java-8.0.25-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11071-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2877-1 No score
Security update for mysql-connector-java
This update for mysql-connector-java fixes the following issues:
- CVE-2020-2875: Unauthenticated attacker with network access via multiple protocols can compromise MySQL Connectors. (bsc#1173600)
- CVE-2020-2934: Fixed a vulnerability which could cause a partial denial of service of MySQL Connectors. (bsc#1173600)
- CVE-2020-2933: Fixed a vulnerability which could allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. (bsc#1173600)
- Record
SUSE-SU-2021:2877-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mysql-connector-javaDebian:8 From an advisory covering 3 CVEs |
before 5.1.49-0+deb8u1, plus listed versions 5.1.32-15.1.37-15.1.38-15.1.39-15.1.39-1~deb7u1 Show 9 moreShow less5.1.39-1~deb8u15.1.40-15.1.41-15.1.41-1~deb8u15.1.42-15.1.42-1~deb7u15.1.42-1~deb8u15.1.44-15.1.45-1 |
5.1.49-0+deb8u1 |
mysql-connector-javaDebian:9 From an advisory covering 3 CVEs |
before 5.1.49-0+deb9u1, plus listed versions 5.1.42-15.1.44-15.1.45-1 |
5.1.49-0+deb9u1 |
mysql-connector-javaSUSE:HPE Helion OpenStack 8 From an advisory covering 3 CVEs |
before 5.1.42-5.7.1 | 5.1.42-5.7.1 |
mysql-connector-javaSUSE:OpenStack Cloud 8 From an advisory covering 3 CVEs |
before 5.1.42-5.7.1 | 5.1.42-5.7.1 |
mysql-connector-javaSUSE:OpenStack Cloud 9 From an advisory covering 3 CVEs |
before 5.1.42-5.7.1 | 5.1.42-5.7.1 |
mysql-connector-javaSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 3 CVEs |
before 5.1.42-5.7.1 | 5.1.42-5.7.1 |
mysql-connector-javaSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 3 CVEs |
before 5.1.42-5.7.1 | 5.1.42-5.7.1 |
mysql-connector-javaSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 3 CVEs |
before 5.1.42-5.7.1 | 5.1.42-5.7.1 |
mysql-connector-javaUbuntu:14.04:LTS |
All versions, plus listed versions 5.1.25-15.1.26-15.1.27-15.1.28-1 |
None known |
mysql-connector-javaUbuntu:16.04:LTS |
All versions, plus listed versions 5.1.32-15.1.38-1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mysql-connector-javaUbuntu:18.04:LTS |
All versions, plus listed versions 5.1.42-15.1.44-15.1.45-1 |
None known |
mysql-connector-javaopenSUSE:Leap 15.2 From an advisory covering 3 CVEs |
before 5.1.47-lp152.2.3.1 | 5.1.47-lp152.2.3.1 |
mysql-connector-javaopenSUSE:Leap 15.3 From an advisory covering 3 CVEs |
before 5.1.47-3.3.1 | 5.1.47-3.3.1 |
mysql-connector-javaopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 8.0.25-2.2 | 8.0.25-2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2875 is a medium vulnerability (CVSS 4.7) in Oracle Corporation Mysql Connectors, published April 15, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.22%, the 82nd percentile. No source names a fixed version.
References
oracle.com/security-alerts/cpuapr2020.html
lists.debian.org/debian-lts-announce/2020/06/msg00015.html
debian.org/security/2020/dsa-4703
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QDR2WOUETBT76WAO5NNCCXSAM3AGG3D
security.gentoo.org/glsa/202105-27
Show 15 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-2875
github.com/advisories/GHSA-cq4v-593f-gw93
suse.com/support/update/announcement/2021/suse-su-20212877-1
bugzilla.suse.com/1173600
ubuntu.com/security/CVE-2020-2875
cve.org/CVERecord?id=CVE-2020-2875
lists.opensuse.org/archives/list/[email protected]/thread/WS25DT4QDBVK3PBC74G4JTBWADK62LTQ