CVE-2020-10997
Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup...
Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table.
- Record
CVE-2020-10997- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table.
- Record
CVE-2020-10997- Updated
- 2026-11-02
EUVDEUVD-2020-3394 No score
Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table.
- Record
EUVD-2020-3394- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p7x7-rwp6-7mfx No score
Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup...
Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table.
- Record
GHSA-p7x7-rwp6-7mfx- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table.
- Record
CVE-2020-10997- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-percona-xtrabackup-2020-10997 No score
Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table.
- Record
BIT-percona-xtrabackup-2020-10997- Updated
- 2026-11-02
OSVBIT-percona-xtrabackup-binary-2020-10997 No score
Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table.
- Record
BIT-percona-xtrabackup-binary-2020-10997- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10212-1 No score
Security update for xtrabackup
This update for xtrabackup fixes the following issues:
Update xtrabackup to version 2.4.26:
- CVE-2020-10997: Information exposure via cmd line output and table history (boo#1170644)
- CVE-2020-29488: Changes in how absolute paths are handled (boo#1205581)
- Record
openSUSE-SU-2022:10212-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
percona-xtrabackupBitnami |
2.4.11 up to 2.4.20, 8.0.4 up to 8.0.11 | 2.4.208.0.11 |
percona-xtrabackup-binaryBitnami |
2.4.11 up to 2.4.20, 8.0.4 up to 8.0.11 | 2.4.208.0.11 |
xtrabackupSUSE:Package Hub 15 SP4 From an advisory covering 2 CVEs |
before 2.4.26-bp154.2.3.1 | 2.4.26-bp154.2.3.1 |
xtrabackupopenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 2.4.26-bp154.2.3.1 | 2.4.26-bp154.2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-10997 is a medium vulnerability (CVSS 6.5) in Percona Xtrabackup, published April 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. Fixed in percona-xtrabackup 2.4.20.
References
jira.percona.com/browse/PXB-2142
percona.com/blog/2020/04/16/cve-2020-10997-percona-xtrabackup-information-disclosure-of-command-line-arguments
nvd.nist.gov/vuln/detail/CVE-2020-10997
github.com/advisories/GHSA-p7x7-rwp6-7mfx
lists.opensuse.org/archives/list/[email protected]/thread/U3RTDTIXGJ3RCHKJUZNBA3BXYPTFKTB7
bugzilla.suse.com/1125418