CRITICALCVSS 9.0

CVE-2020-15180

CVE-2020-15180 updated by NVD

Modified: 2026-09-20
Sources: nvd

Summary

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
MariaDB	mariadb	[object Object], [object Object], [object Object], [object Object], [object Object]	—

References

https://nvd.nist.gov/vuln/detail/CVE-2020-15180

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.