title: Apache ShardingSphere-Proxy: MySQL authentication bypass
description: Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This vulnerability has been fixed in Apache ShardingSphere 5.3.0.
problem types: CWE-459 Incomplete Cleanup
affected:
{
defaultStatus: unaffected
product: Apache ShardingSphere-Proxy
vendor: Apache Software Foundation
versions:
lessThan: 5.3.0, status: affected, version: 0, versionType: maven
}
metrics:
other: [
content: {'text': 'moderate'}
type: Textual description of severity
]