A vulnerability in Oracle MySQL Shell’s Dump and Load component allows an unauthenticated attacker who can reach the service over the network to compromise the shell. The known issue requires an attacker to leverage human interaction from a person other than the attacker, suggesting that a social‑engineering or credential‑harvesting approach may be needed before the exploit can be triggered. Once compromised, the attacker can read any critical data available through the shell, resulting in a disclosure of confidential information. The weakness aligns with an improper access control flaw (CWE‑284) and directly affects data confidentiality, with no denial of service or code execution impact.

MySQL Shell from Oracle Corporation, versions 8.4.0 through 8.4.9 and 9.0.0 through 9.7.0. Any installation that has the Dump and Load functionality enabled and is reachable over network protocols is susceptible. Users should verify the installed version against the affected ranges and apply the fix if applicable.

The CVSS score of 6.5 categorizes this flaw as moderate severity, while an EPSS score of less than 1% indicates a very low current exploitation probability; the vulnerability is also not listed in CISA KEV. Exploitation requires network access and human interaction, reducing the likelihood of automated attacks but still presenting a tangible risk to confidentiality. Timely remediation is recommended to prevent unauthorized data access from occurring.