This vulnerability allows an attacker to obtain the cleartext database password during the initial SSL handshake of a MariaDB Connector/J connection. When the client uses sslMode=verify-full or sslMode=verify-ca but fails to supply a trusted server certificate or trust store, the connector accepts a self‑signed certificate through a fallback trust manager and records its fingerprint. The initial authentication path does not enforce that fingerprint before sending a mysql_clear_password response, exposing the password. The flaw corresponds to CWE‑295 – cleartext transmission of sensitive information – and to CWE‑522 – inadequate protection of stored credentials. The attacker can thus perform a man‑in‑the‑middle or malicious server impersonation and capture the password before the connection is rejected.

MariaDB Connector/J supplied by MariaDB Corporation. Versions lower than 2.7.14, 3.3.5, 3.4.3, and 3.5.9 are affected. The issue is mitigated in these releases and later versions.

The CVSS score is 5.9, indicating a medium severity risk. The EPSS score is 0.00222 (0.222%), indicating a very low but non‑zero probability that this vulnerability will be exploited; its KEV status is not listed, suggesting no known active exploitation. An attacker would need network access to the client or to lie as the database server during SSL negotiation. The vulnerability can be exploited when sslMode is set to verify-full or verify-ca without a configured trusted certificate store, and the client accepts mysql_clear_password as the initial authentication plugin. If the attacker succeeds, they obtain the full database credentials in cleartext. The problem is resolved in the patched Connector/J versions.