LiveActive security incident?Get immediate response
CVE Record

CVE-2023-22053: Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.42 and prior and 8.0.33 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server and unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H).

MediumCVSS 5.9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This MySQL issue can let a low-privileged network attacker crash the database repeatedly and read some database-accessible information. It is not rated critical because exploitation is difficult and requires privileges, but outage impact can be serious for business systems that rely on MySQL availability.

Executive priority

Treat as a scheduled but important remediation item. The strongest business risk is repeatable database outage, with some confidentiality impact. Escalate priority for internet-adjacent, shared, or mission-critical MySQL environments.

Technical view

CVE-2023-22053 affects Oracle MySQL Server client programs in supported versions 5.7.42 and earlier and 8.0.33 and earlier. The CVSS 3.1 score is 5.9, with network attack vector, high complexity, low privileges required, low confidentiality impact, and high availability impact.

Likely exposure

Exposure is most likely where Oracle MySQL Server 5.7.42 or older, or 8.0.33 or older, remains deployed. Referenced NetApp and Fedora advisories indicate downstream or packaged environments may also need vendor-specific review.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation evidence. Oracle describes the issue as difficult to exploit and requiring low-privileged network access via multiple protocols. No exploit steps are provided here.

Researcher notes

No CWE is listed in the supplied data. The component is identified as MySQL Server client programs, but Oracle's impact statement is server compromise causing DoS and limited read access. Vendor guidance should be used for exact fixed builds.

Mitigation direction

  • Upgrade affected MySQL Server deployments to Oracle's July 2023 CPU level or later supported releases.
  • Check Oracle, Fedora, NetApp, and platform-specific advisories for applicable update packages.
  • Prioritize systems supporting critical applications or reachable by broad internal user populations.
  • Restrict MySQL network access to trusted hosts and required service accounts where feasible.
  • Monitor database crash, restart, and unusual read-access patterns until updates are complete.

Validation and detection

  • Inventory MySQL Server versions and flag 5.7.42 or earlier and 8.0.33 or earlier.
  • Confirm installed packages include vendor fixes from the July 2023 advisory cycle or later.
  • Review exposure paths for low-privileged accounts with network access to MySQL services.
  • Verify downstream products against NetApp, Fedora, or other supplier advisories if applicable.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-22053 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.9 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.9CVSS 3.1MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H1.64.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.9Medium
CVSS 3.1 vector shape for CVE-2023-22053Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Oracle CorporationMySQL Server*, *Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.