THREATPORT/VULNERABILITY/CVE-2021-27928
HIGH SEVERITY

CVE-2021-27928

Mariadb vulnerability

CVSS
7.2
EPSS
38.2%
EPSS pct
98th
Exploited
No known
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.
Affected vendor
Mariadb
Affected product
Mariadb
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness type (CWE)
Published
2021-03-19

Risk analysis

Based on its CVSS vector, this vulnerability is exploitable over the network, low attack complexity, requiring high privileges, no user interaction. Successful exploitation leads to high impact to confidentiality, high impact to integrity, high impact to availability.

Its EPSS score of 38.2% reflects a moderate probability of exploitation activity in the wild over the next 30 days, placing it above 98% of all scored CVEs.

Check your external exposure to CVE-2021-27928

  • Confirm whether Mariadb Mariadb is running on any internet-facing host or subdomain.
  • Match discovered service fingerprints against the version affected by CVE-2021-27928.
  • Prioritise remediation if the asset is public, business-critical, or near authentication/payment flows.

How ThreatPort helps with CVE-2021-27928

ThreatPort's external attack surface scanner checks your internet-facing assets — agentlessly, from the outside in — for the exposed services and versions that CVE-2021-27928 affects, then prioritises the finding by real risk using CISA KEV and FIRST.org EPSS.

Run a free external exposure scan

Are you exposed to CVE-2021-27928?

Run an instant, non-intrusive external scan to check your attack surface for CVE-2021-27928.

Start free scan

No credit card. Agentless.

Related vulnerabilities

HIGH
CVE-2014-8966
Internet Explorer vulnerability
HIGH
CVE-2014-7192
Node.Js vulnerability
HIGH
CVE-2014-8373
Vcloud Automation Center vulnerability