{"id":"CVE-2025-30706","aliases":["EUVD-2025-11044","GHSA-mxpq-3mg3-vqx7","SUSE-SU-2025:21144-1","UBUNTU-CVE-2025-30706","openSUSE-SU-2025:15026-1","openSUSE-SU-2025:20089-1"],"status":"published","title":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). ...","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).  Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00642,"percentile":0.51129,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276"],"published":"2025-04-15T20:31:08Z","modified":"2026-09-03T18:52:44Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"mysql-connector-java","fixed_in":["9.3.0-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"mysql-connector-java","fixed_in":["9.3.0-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mysql-connector-java","fixed_in":["9.3.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"mysql-connector-java","fixed_in":["9.3.0-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.0-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.0-160000.1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.25-1","5.1.26-1","5.1.27-1","5.1.28-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.32-1","5.1.38-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.42-1","5.1.44-1","5.1.45-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"mysql-connector-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.0-160000.1.1"}]}]}],"products":[{"vendor":"oracle","product":"mysql_connector\\/j"},{"vendor":"oracle corporation","product":"mysql connectors"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2025.html","tags":["vendor-advisory","Patch","Vendor Advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20250418-0007/","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30706"},{"url":"https://security.netapp.com/advisory/ntap-20250418-0007"},{"url":"https://github.com/advisories/GHSA-mxpq-3mg3-vqx7"},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521144-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241693","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30706","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-30706","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30706","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-30706","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).  Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2025-04-15T20:31:08.449Z","modified":"2026-02-26T18:28:20.627Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:32:35.418416Z"}],"euvd":[{"id":"EUVD-2025-11044","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).  Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2025-04-15T20:31:08Z","modified":"2026-02-26T18:28:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:17.446722Z"}],"ghsa":[{"id":"GHSA-mxpq-3mg3-vqx7","title":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). ...","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).  Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2025-04-15T21:31:47Z","modified":"2025-04-19T03:32:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T15:01:38.442003Z"}],"nvd":[{"id":"CVE-2025-30706","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).  Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2025-04-15T21:16:00.043Z","modified":"2026-09-03T18:52:44.433Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:11:00.456643Z"}],"osv":[{"id":"UBUNTU-CVE-2025-30706","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).  Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2025-04-15T21:16:00Z","modified":"2025-10-24T05:18:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:28.829873Z"},{"id":"openSUSE-SU-2025:15026-1","title":"mysql-connector-java-9.3.0-1.1 on GA media","description":"These are all security issues fixed in the mysql-connector-java-9.3.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-24T00:00:00Z","modified":"2026-02-04T02:51:32.111149Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:20089-1","title":"Security update for mysql-connector-java","description":"This update for mysql-connector-java fixes the following issues:\n\n- Upgrade to Version 9.3.0\n  - CVE-2025-30706: Fixed Connector/J vulnerability (bsc#1241693)\n  - Updatable ResultSet fails with 'Parameter index out of range'.\n  - Fixed Resultset UPDATE methods not checking validity of ResultSet.\n  - DatabaseMetaData clean up.\n  - Fixed implement missing methods in DatabaseMetaDataUsingInfoSchema.\n  - Fixed procedure execution failing when the parameter name contains escape character.\n  - Fixed allow only Krb5LoginModule in Kerberos authentication.\n  - Fixed EXECUTE on CallableStatement resulting in ArrayIndexOutOfBoundsException.\n  - Mysql connector use an uneffective way to match numericValue.\n  - Fixed parameter index validation not proper in CallableStatement\n","status":"published","published":"2025-11-26T08:12:25Z","modified":"2026-03-23T04:54:16.80683Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"SUSE-SU-2025:21144-1","title":"Security update for mysql-connector-java","description":"This update for mysql-connector-java fixes the following issues:\n\n- Upgrade to Version 9.3.0\n  - CVE-2025-30706: Fixed Connector/J vulnerability (bsc#1241693)\n  - Updatable ResultSet fails with 'Parameter index out of range'.\n  - Fixed Resultset UPDATE methods not checking validity of ResultSet.\n  - DatabaseMetaData clean up.\n  - Fixed implement missing methods in DatabaseMetaDataUsingInfoSchema.\n  - Fixed procedure execution failing when the parameter name contains escape character.\n  - Fixed allow only Krb5LoginModule in Kerberos authentication.\n  - Fixed EXECUTE on CallableStatement resulting in ArrayIndexOutOfBoundsException.\n  - Mysql connector use an uneffective way to match numericValue.\n  - Fixed parameter index validation not proper in CallableStatement\n","status":"published","published":"2025-11-26T08:13:19Z","modified":"2026-03-23T04:49:17.16335Z","updated_at":"2026-11-02T15:54:00.344164Z"}]}}