Medium severity · published Jun 2, 2022
CVE-2022-26944
Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output
6.5
CVSS
1%
EPSS
No
On KEV
Description
Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table. NOTE: this issue exists because of an incomplete fix for CVE-2020-10997.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XT
Xtrabackup · Percona
2.4.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-26944
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-26944
Release Notes
https://docs.percona.com/percona-xtrabackup/2.4/release-notes/2.4/2.4.25.html
Permissions Required
https://jira.percona.com/browse/PXB-2722
More from Xtrabackup
7.8
CVE-2022-25834
In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary…
6.5
CVE-2020-10997
Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output
5.9
CVE-2015-1027
The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which…
5.9
CVE-2016-6225
xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector (IV) for encryption, which makes it easier for context-dependent…
–
CVE-2013-6394
Percona XtraBackup before 2.1.6 uses a constant string for the initialization vector (IV), which makes it easier for local users to defeat cryptographic protection mechanisms and…