Published: 06/10/2008 Updated: 17/12/2019

CVSS v2 Base Score: 2.6 | Impact Score: 2.9 | Exploitability Score: 4.9

VMScore: 265

Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 up to and including 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows malicious users to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle mysql 5.0.32
oracle mysql 5.0.33
oracle mysql 5.0.45
oracle mysql 5.0.67
mysql mysql 5.0.30
oracle mysql 5.0.30
mysql mysql 5.0.36
oracle mysql 5.0.37
oracle mysql 5.0.41
oracle mysql 5.0.42
mysql mysql 5.0.44
oracle mysql 5.0.26
oracle mysql 5.0.27
oracle mysql 5.0.38
mysql mysql 5.0.4

Synopsis Moderate: mysql security update Type/Severity Security Advisory: Moderate Topic Updated mysql packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4This update has been rated as having moderate security impact by the RedHat Security Response Team Descri ...

Multiple vulnerabilities have been identified affecting MySQL, a relational database server, and its associated interactive client application The Common Vulnerabilities and Exposures project identifies the following two problems: CVE-2008-3963 Kay Roepke reported that the MySQL server would not properly handle an empty bit-string literal ...

Several security issues were fixed in MySQL ...

It was discovered that MySQL could be made to overwrite existing table files in the data directory An authenticated user could use the DATA DIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks This update alters table creation behaviour by disallowing the use of the MySQL data directory in DATA DIRECTORY and INDEX DIRECTORY o ...

source: wwwsecurityfocuscom/bid/31486/info MySQL is prone to an HTML-injection vulnerability because the application's command-line client fails to properly sanitize user-supplied input before using it in dynamically generated content Attacker-supplied HTML and script code would run in the context of the affected browser, potentially al ...

CWE-79 http://bugs.mysql.com/bug.php?id=27884 http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability http://secunia.com/advisories/32072 http://seclists.org/bugtraq/2008/Oct/0026.html http://securityreason.com/securityalert/4357 http://www.mandriva.com/security/advisories?name=MDVSA-2009:094 http://secunia.com/advisories/34907 http://www.debian.org/security/2009/dsa-1783 http://www.securityfocus.com/bid/31486 http://www.redhat.com/support/errata/RHSA-2010-0110.html http://secunia.com/advisories/38517 http://ubuntu.com/usn/usn-897-1 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://support.apple.com/kb/HT4077 http://secunia.com/advisories/36566 http://www.redhat.com/support/errata/RHSA-2009-1289.html https://exchange.xforce.ibmcloud.com/vulnerabilities/45590 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11456 http://www.ubuntu.com/usn/USN-1397-1 http://www.securityfocus.com/archive/1/497885/100/0/threaded http://www.securityfocus.com/archive/1/497158/100/0/threaded http://www.securityfocus.com/archive/1/496877/100/0/threaded http://www.securityfocus.com/archive/1/496842/100/0/threaded https://access.redhat.com/errata/RHSA-2010:0110 https://nvd.nist.gov https://usn.ubuntu.com/1397-1/https://www.exploit-db.com/exploits/32445/https://www.debian.org/security/./dsa-1783

CVE-2008-4456

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect