CVE-2020-10996 — Hard-coded Credentials in Xtradb Cluster

CWE-798 — Hard-coded CredentialsCWE-838 — Inappropriate Encoding for Output ContextCWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
8.1HIGHNVD
EPSS
0.6%
top 31.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Percona Xtradb Cluster
Timeline
PublishedApr 27
Latest updateMay 24

Description

An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A bundled script inadvertently sets a static transition_key for SST processes in place of the random key expected.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages1 packages

▶NVDpercona/xtradb_cluster< 5.7.28-31.41.2

🔴Vulnerability Details

3
GHSA
GHSA-4r6g-prvv-3gp3: An issue was discovered in Percona XtraDB Cluster before 5↗2022-05-24
▶
OSV
CVE-2020-10996: An issue was discovered in Percona XtraDB Cluster before 5↗2020-04-27
▶
CVEList
CVE-2020-10996: An issue was discovered in Percona XtraDB Cluster before 5↗2020-04-27
▶
CVE-2020-10996 — Hard-coded Credentials | cvebase