MySQL Unpassworded Account Check

High Nessus Plugin ID 10481

Synopsis

The remote database server can be accessed without a password.

Description

It is possible to connect to the remote MySQL database server using an unpassworded account. This may allow an attacker to launch further attacks against the database.

Solution

Disable or set a password for the affected account.

See Also

https://dev.mysql.com/doc/refman/8.0/en/default-privileges.html

Plugin Details

Severity: High

ID: 10481

File Name: mysql_unpassworded.nasl

Version: 1.62

Type: remote

Family: Databases

Published: 2000/07/27

Updated: 2018/11/15

Dependencies: 11153

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSS v3.0

Base Score: 7.3

Temporal Score: 6.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mysql:mysql

Excluded KB Items: global_settings/supplied_logins_only

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2002/08/18

Reference Information

CVE: CVE-2002-1809, CVE-2004-1532

BID: 11704