Security readout for executives and security teams
Plain-English summary
This is a low-severity information disclosure issue in Oracle MySQL Client’s C API. An unauthenticated attacker with network access could, under difficult conditions, cause a vulnerable client to expose a limited subset of data accessible to that client. Business risk is mainly in environments still running older MySQL client libraries.
Executive priority
Schedule remediation through normal patch management, with faster handling for systems that connect over untrusted networks or process sensitive data. This does not currently justify emergency response based on the provided sources, but unsupported legacy MySQL clients should be retired or isolated.
Technical view
CVE-2020-2922 affects Oracle MySQL Client C API in 5.6.47 and prior, 5.7.29 and prior, and 8.0.18 and prior. The CVSS 3.0 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network reachability, high attack complexity, no privileges or user interaction, and limited confidentiality impact.
Likely exposure
Exposure is most likely in systems using old MySQL client packages or applications linked against vulnerable MySQL C API libraries. Server-only inventories may miss affected client components. Downstream vendor advisories from Ubuntu, Gentoo, and NetApp indicate packaged ecosystem impact, but the prompt bundle does not detail each downstream product scope.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Oracle rates exploitation as difficult, requiring unauthenticated network access via multiple protocols. Treat this as a patch hygiene and data exposure issue unless local threat modeling identifies untrusted network paths to vulnerable clients.
Researcher notes
Key uncertainty is product-specific downstream exposure. The public description names MySQL Client C API, while the affected bundle lists Oracle MySQL Server versions. Validate the actual installed client library/package lineage, not just database server versions. No CWE, exploit detail, or active exploitation evidence is provided in the bundle.
Mitigation direction
- Identify MySQL client and libmysqlclient versions across servers, containers, and application images.
- Update affected Oracle MySQL Client versions using Oracle CPU guidance.
- Apply fixed packages from OS or appliance vendors where applicable.
- Prioritize internet-facing or untrusted-network client use cases first.
- Monitor Oracle and downstream vendor advisories for product-specific instructions.
Validation and detection
- Confirm no MySQL Client C API versions are at or below affected thresholds.
- Check package manager evidence for fixed Ubuntu, Gentoo, or vendor packages.
- Inventory applications dynamically or statically linked to MySQL client libraries.
- Verify vulnerable client libraries are removed from containers and build images.
- Document exceptions where vendor fixes are unavailable or unsupported.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-2922 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.7 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N2.21.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
3.7LowVector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuapr2020.htmlCVE reference · x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20200416-0003/CVE reference · x_refsource_CONFIRM
- USN-4350-1CVE reference · vendor-advisory, x_refsource_UBUNTU
- GLSA-202105-27CVE reference · vendor-advisory, x_refsource_GENTOO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.