Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Shell).
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Shell). Supported versions that are affected are 8.0.13 and prior. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 2.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Oracle | MySQL Server | up to 8.0.13 | — | No fix listed | CNA |
- MySQL Server VendorOracle Affected up to 8.0.13 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* | 8.0.0 to before 8.0.13 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vsphere:*:* | 7.3 – 9.5 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:* | 7.3 – 9.5 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.0.13 Vulnerable ·Oracle
- cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vsphere:*:* Versions 7.3 – 9.5 Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:* Versions 7.3 – 9.5 Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 10 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 14 (Rocky)
- Red Hat OpenStack Platform 8 (Liberty)
- Red Hat OpenStack Platform 9 (Mitaka)
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2019-2513
- 2026-10-03 Alias added: GHSA-rmc9-q2qr-2743
References
More Oracle Mysql vulnerabilities
- TI-2017-02794 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server… CVSS 3.0HIGH 7.5
- TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
- TI-2003-00723 Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier… CVSS 2.0HIGH 9.0
- TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
- TI-2008-00208 Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other… CVSS 2.0HIGH 7.5
- TI-2020-01888 Segmentation fault in SSL_check_chain CVSS 3.1HIGH 7.5
Sources
- CVE-2019-2513 · CVE Program
- CVE-2019-2513 · NVD
- FIRST EPSS
- GHSA-rmc9-q2qr-2743 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-2513 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences