Vulnerability · Published Sep 2, 2025 · Assigned by zdi

CVE-2025-9273CData API Server MySQL Misconfiguration Information Disclosure Vulnerability

Medium 4.3

In plain English

A medium-severity security flaw in API Server from CData. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.0)4.3Medium

Exploit odds (30 days)0.4%top 66.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CData API Server MySQL Misconfiguration Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of CData API Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the usage of MySQL connections. When connecting to a MySQL server, the product enables an option that gives the MySQL server permission to request local files from the MySQL client. An attacker can leverage this vulnerability to disclose information in the context of NETWORK SERVICE. Was ZDI-CAN-23950.

Affected products (as reported)

Vendor	Product	Versions
CData	API Server	23.0.8844.0

Weakness: CWE-552 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

ZDI-25-852 x_research-advisory