Medium severity · published Sep 29, 2017
CVE-2015-1027
The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which…
5.9
CVSS
1.2%
EPSS
No
On KEV
Description
The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which the server response could be modified to allow the attacker to respond with modified command payload and have the client return additional running configuration information leading to an information disclosure of running configuration of MySQL.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Toolkit · Percona
through 2.2.12 · source: NVD
XT
Xtrabackup · Percona
through 2.2.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1027
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1027
Issue Tracking
https://bugs.launchpad.net/percona-toolkit/+bug/1408375
Exploit
https://www.percona.com/blog/2015/05/06/percona-security-advisory-cve-2015-1027/
More from Toolkit
8.1
CVE-2014-2029
The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code by…
7.5
CVE-2024-7701
Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption Brute Forcing.This issue affects percona-toolkit: 3.6.0