Description
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
Scores
CVSS v3
4.3
EPSS
0.0001
EPSS Percentile
3.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-778
Status
published
Products (20)
Amazon/Aurora MySQL
2.12.6
Amazon/Aurora MySQL
3.04.6
Amazon/Aurora MySQL
3.10.3
Amazon/Aurora MySQL
3.11.1
amazon/aurora_mysql
3.11.0
amazon/aurora_mysql
< 2.12.5
Amazon/RDS for MariaDB
10.11.16
Amazon/RDS for MariaDB
10.6.25
Amazon/RDS for MariaDB
11.4.10
Amazon/RDS for MariaDB
11.8.6
... and 10 more
Published
Mar 03, 2026
Tracked Since
Mar 04, 2026