CyberRota Analysis
AI-GeneratedThe MariaDB Connector/R2DBC prior to version 1.4.1 is vulnerable to clear-text password exposure due to a lack of transport encryption enforcement in its authentication plugins. An attacker, such as a man-in-the-middle, can exploit this vulnerability to intercept and capture user credentials transmitted over an unencrypted connection. Organizations using affected versions of the connector should prioritize upgrading to version 1.4.1 to mitigate the risk of credential theft.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a secure connection. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP unencrypted connection, and AuthenticationFlow permits ClearPasswordPluginFlow or PamPluginFlow to return the user's password as cleartext bytes on the wire. The disclosed credentials can subsequently be used to authenticate directly to the database server. This issue is fixed in version 1.4.1.