Read the docs
TI-2002-01840 Aliases CVE-2002-1921GHSA-c36p-446q-54r5

The default configuration of MySQL 3.20.32 through 3.23.52, when running on Windows, does…

Priority LOW 38Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The default configuration of MySQL 3.20.32 through 3.23.52, when running on Windows, does set the bind address to the loopback interface, which allows remote attackers to connect to the database.

Why it matters now

EPSS 0.0253 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 42

CPEVersionsRoleVendor
cpe:2.3:a:oracle:mysql:3.20.32a:*:*:*:*:*:*:*3.20.32aVulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.26:*:*:*:*:*:*:*3.22.26VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.27:*:*:*:*:*:*:*3.22.27VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.28:*:*:*:*:*:*:*3.22.28VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.29:*:*:*:*:*:*:*3.22.29VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.30:*:*:*:*:*:*:*3.22.30VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.32:*:*:*:*:*:*:*3.22.32VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.2:*:*:*:*:*:*:*3.23.2VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.3:*:*:*:*:*:*:*3.23.3VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.4:*:*:*:*:*:*:*3.23.4VulnerableOracle
  • cpe:2.3:a:oracle:mysql:3.20.32a:*:*:*:*:*:*:* Versions 3.20.32a Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.26:*:*:*:*:*:*:* Versions 3.22.26 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.27:*:*:*:*:*:*:* Versions 3.22.27 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.28:*:*:*:*:*:*:* Versions 3.22.28 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.29:*:*:*:*:*:*:* Versions 3.22.29 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.30:*:*:*:*:*:*:* Versions 3.22.30 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.32:*:*:*:*:*:*:* Versions 3.22.32 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.2:*:*:*:*:*:*:* Versions 3.23.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.3:*:*:*:*:*:*:* Versions 3.23.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.4:*:*:*:*:*:*:* Versions 3.23.4 Vulnerable ·Oracle
Show 32 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:mysql:3.23.5:*:*:*:*:*:*:*3.23.5VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.8:*:*:*:*:*:*:*3.23.8VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.9:*:*:*:*:*:*:*3.23.9VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.10:*:*:*:*:*:*:*3.23.10VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.23:*:*:*:*:*:*:*3.23.23VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.24:*:*:*:*:*:*:*3.23.24VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.25:*:*:*:*:*:*:*3.23.25VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.26:*:*:*:*:*:*:*3.23.26VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.27:*:*:*:*:*:*:*3.23.27VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.28:*:*:*:*:*:*:*3.23.28VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.28:gamma:*:*:*:*:*:*3.23.28 gammaVulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.29:*:*:*:*:*:*:*3.23.29VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.30:*:*:*:*:*:*:*3.23.30VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.31:*:*:*:*:*:*:*3.23.31VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.34:*:*:*:*:*:*:*3.23.34VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.36:*:*:*:*:*:*:*3.23.36VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.37:*:*:*:*:*:*:*3.23.37VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.38:*:*:*:*:*:*:*3.23.38VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.39:*:*:*:*:*:*:*3.23.39VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.40:*:*:*:*:*:*:*3.23.40VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.41:*:*:*:*:*:*:*3.23.41VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.42:*:*:*:*:*:*:*3.23.42VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.43:*:*:*:*:*:*:*3.23.43VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.44:*:*:*:*:*:*:*3.23.44VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.45:*:*:*:*:*:*:*3.23.45VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.46:*:*:*:*:*:*:*3.23.46VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.47:*:*:*:*:*:*:*3.23.47VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.48:*:*:*:*:*:*:*3.23.48VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.49:*:*:*:*:*:*:*3.23.49VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.50:*:*:*:*:*:*:*3.23.50VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.51:*:*:*:*:*:*:*3.23.51VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.52:*:*:*:*:*:*:*3.23.52VulnerableOracle
  • cpe:2.3:a:oracle:mysql:3.23.5:*:*:*:*:*:*:* Versions 3.23.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.8:*:*:*:*:*:*:* Versions 3.23.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.9:*:*:*:*:*:*:* Versions 3.23.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.10:*:*:*:*:*:*:* Versions 3.23.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.23:*:*:*:*:*:*:* Versions 3.23.23 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.24:*:*:*:*:*:*:* Versions 3.23.24 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.25:*:*:*:*:*:*:* Versions 3.23.25 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.26:*:*:*:*:*:*:* Versions 3.23.26 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.27:*:*:*:*:*:*:* Versions 3.23.27 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.28:*:*:*:*:*:*:* Versions 3.23.28 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.28:gamma:*:*:*:*:*:* Versions 3.23.28 gamma Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.29:*:*:*:*:*:*:* Versions 3.23.29 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.30:*:*:*:*:*:*:* Versions 3.23.30 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.31:*:*:*:*:*:*:* Versions 3.23.31 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.34:*:*:*:*:*:*:* Versions 3.23.34 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.36:*:*:*:*:*:*:* Versions 3.23.36 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.37:*:*:*:*:*:*:* Versions 3.23.37 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.38:*:*:*:*:*:*:* Versions 3.23.38 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.39:*:*:*:*:*:*:* Versions 3.23.39 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.40:*:*:*:*:*:*:* Versions 3.23.40 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.41:*:*:*:*:*:*:* Versions 3.23.41 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.42:*:*:*:*:*:*:* Versions 3.23.42 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.43:*:*:*:*:*:*:* Versions 3.23.43 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.44:*:*:*:*:*:*:* Versions 3.23.44 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.45:*:*:*:*:*:*:* Versions 3.23.45 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.46:*:*:*:*:*:*:* Versions 3.23.46 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.47:*:*:*:*:*:*:* Versions 3.23.47 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.48:*:*:*:*:*:*:* Versions 3.23.48 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.49:*:*:*:*:*:*:* Versions 3.23.49 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.50:*:*:*:*:*:*:* Versions 3.23.50 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.51:*:*:*:*:*:*:* Versions 3.23.51 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.52:*:*:*:*:*:*:* Versions 3.23.52 Vulnerable ·Oracle

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2002-1921
  2. 2026-10-03 Alias added: GHSA-c36p-446q-54r5

References

Other 1

  • TI-2017-02794 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server… CVSS 3.0HIGH 7.5
  • TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
  • TI-2003-00723 Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier… CVSS 2.0HIGH 9.0
  • TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
  • TI-2008-00208 Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other… CVSS 2.0HIGH 7.5
  • TI-2020-01888 Segmentation fault in SSL_check_chain CVSS 3.1HIGH 7.5
See all 1327 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences