What it is about

MariaDB ist ein relationales Datenbanksystem, das anwendungskompatibel mit MySQL ist. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MariaDB Connector/Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen, SQL-Injection-Angriffe durchzuführen, Daten offenzulegen oder zu manipulieren.

Under what conditions?

Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.

What can happen in the worst case

An attacker could use the vulnerability to

• einen Denial of Service Angriff durchzuführen
• SQL-Injection-Angriffe durchzuführen
• Daten offenzulegen oder zu manipulieren

Am I affected?

Affected according to the BSI:

• MariaDB MariaDB Connector/Node.js <3.2.5
• MariaDB MariaDB Connector/Node.js <3.3.4
• MariaDB MariaDB Connector/Node.js <3.4.7
• MariaDB MariaDB Connector/Node.js <3.5.4

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• MariaDB MariaDB Connector/Node.js 3.2.5
• MariaDB MariaDB Connector/Node.js 3.3.4
• MariaDB MariaDB Connector/Node.js 3.4.7
• MariaDB MariaDB Connector/Node.js 3.5.4

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.