CVE-2025-21540: 
MySQL vulnerability analysis and mitigation

CVE-2025-21540 is a security vulnerability discovered in Oracle MySQL Server (component: Server: Security: Privileges) affecting versions 8.0.40 and prior, 8.4.3 and prior, and 9.1.0 and prior. The vulnerability was disclosed on January 21, 2025 (NVD, Oracle CPU).

This is an easily exploitable vulnerability that allows low-privileged attackers with network access to compromise MySQL Server via multiple protocols. The vulnerability has a CVSS v3.1 Base Score of 5.4 (Medium severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality and integrity (NVD).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some MySQL Server accessible data, as well as unauthorized read access to a subset of MySQL Server accessible data (Oracle CPU).

Oracle has released patches to address this vulnerability in the January 2025 Critical Patch Update. Users are advised to upgrade to MySQL version 8.0.41 which contains fixes for this vulnerability (Ubuntu Notice).