Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-1027

The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which the server response could be modified to allow the attacker to respond with modified command payload and have the client return additional running configuration information leading to an information disclosure of running configuration of MySQL.

Published

2017-09-29T01:34:47.907

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 5.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-200

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	percona	toolkit	≤ 2.2.12	Yes
Application	percona	xtrabackup	≤ 2.2.8	Yes

References

https://bugs.launchpad.net/percona-toolkit/+bug/1408375 Issue Tracking, Third Party Advisory ([email protected])
https://www.percona.com/blog/2015/05/06/percona-security-advisory-cve-2015-1027/ Exploit, Mitigation, Vendor Advisory ([email protected])
https://bugs.launchpad.net/percona-toolkit/+bug/1408375 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.percona.com/blog/2015/05/06/percona-security-advisory-cve-2015-1027/ Exploit, Mitigation, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)