https://bugzilla.redhat.com/show_bug.cgi?id=2020583
--- Comment #3 from Jonathan Christison <jochrist(a)redhat.com> ---
We disagree with some aspects of this base flaw's scoring and suggest the
following corrections
Exploitability Metrics:
Privileges Required (PR:H) -
We disagree here. We believe it should be None (PR:N) instead of High as the
description says[1]: "Successful attacks of this vulnerability can result in
unauthorized access to critical data or complete access to all MySQL Connectors
accessible data and unauthorized ability to cause a hang or frequently
repeatable crash (complete DOS) of MySQL Connectors" and also there is no
evidence that an attacker needs to be privileged to exploit this flaw, though
it is end-application implementation dependent this is covered under the attack
complexity metric.
Current Score: 5.9/CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H
Suggested Score: 7.4/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
[1]
https://nvd.nist.gov/vuln/detail/CVE-2021-2471
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2020583