CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-25834
https://notcve.org/view.php?id=CVE-2022-25834
In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands. • https://docs.percona.com/percona-xtrabackup/8.0/release-notes/8.0/8.0.32-26.0.html#improvements https://www.percona.com/doc/percona-xtrabackup/2.4/index.html • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26944
https://notcve.org/view.php?id=CVE-2022-26944
Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table. NOTE: this issue exists because of an incomplete fix for CVE-2020-10997. Percona XtraBackup versión 2.4.20, escribe involuntariamente la línea de comandos en cualquier archivo de copia de seguridad resultante. • https://docs.percona.com/percona-xtrabackup/2.4/release-notes/2.4/2.4.25.html https://jira.percona.com/browse/PXB-2722 •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10997
https://notcve.org/view.php?id=CVE-2020-10997
Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table. Percona XtraBackup versiones anteriores a la versión 2.4.20, escribe involuntariamente en la línea de comandos en cualquier salida de archivo de copia de seguridad resultante. Esto puede incluir argumentos confidenciales pasados durante el tiempo de ejecución. • https://jira.percona.com/browse/PXB-2142 https://www.percona.com/blog/2020/04/16/cve-2020-10997-percona-xtrabackup-information-disclosure-of-command-line-arguments • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •