This vulnerability allows an attacker to obtain the cleartext database password during the initial SSL handshake of a MariaDB Connector/J connection. When the client uses sslMode=verify-full or sslMode=verify-ca but does not supply a trusted server certificate or trust store, the connector accepts a self‑signed certificate through an fallback trust manager and records its fingerprint. The initial authentication path, however, does not enforce that fingerprint before sending a mysql_clear_password response. As a result, an active man‑in‑the‑middle or a malicious server can present its own certificate, use the mysql_clear_password plugin, and capture the password before the connection is rejected. The weakness is an improper protection of stored information (CWE-522).

MariaDB Connector/J supplied by MariaDB Corporation. Versions lower than 2.7.14, 3.3.5, 3.4.3, and 3.5.9 are affected. The issue is mitigated in these releases and later versions.

The CVSS score is 5.9, indicating a medium severity risk. No EPSS score is available, but the lack of a KEV listing suggests no known active exploit at the time of analysis. An attacker would need network access to the client or to lie as the database server during SSL negotiation. The vulnerability can be exploited when sslMode is set to verify-full or verify-ca without a configured trusted certificate store, and the client accepts mysql_clear_password as the initial authentication plugin. If the attacker succeeds, they obtain the full database credentials in cleartext. The problem is resolved in the patched Connector/J versions.