CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2022-31011
High (7.8) in pingcap tidb. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/pingcap/tidb 0.0.0-20220221072141-27ffd1126da1, 1.1.0-beta.0.20220221072141-27ffd1126da1, 5.3.1.
TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads. Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access. Only users using TiDB 5.3.0 are affected by this vulnerability. TiDB version 5.3.1 contains a patch for this issue. Other mitigation strategies include turning off Security Enhanced Mode (SEM), disabling local login for non-root accounts, and ensuring that the same IP cannot be logged in as root and normal user at the same time.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pingcap:tidb
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4whx-7p29-mq22 | Go | github.com/pingcap/tidb | >=5.3.0 <5.3.1 | 5.3.1 |
| GHSA-4whx-7p29-mq22 | Go | github.com/pingcap/tidb | >=0.0.0-20210808221113-a7fdc2a05663 <0.0.0-20220221072141-27ffd1126da1 | 0.0.0-20220221072141-27ffd1126da1 |
| GHSA-4whx-7p29-mq22 | Go | github.com/pingcap/tidb | >=1.1.0-beta.0.20210808221113-a7fdc2a05663 <1.1.0-beta.0.20220221072141-27ffd1126da1 | 1.1.0-beta.0.20220221072141-27ffd1126da1 |