CVE-2010-1848

MySQL 5.0-5.0.91 and 5.1 < 5.1.47 - Authenticated Path Traversal via Table Name

Title source: llm

Description

Directory traversal vulnerability in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to bypass intended table grants to read field definitions of arbitrary tables, and on 5.1 to read or delete content of arbitrary tables, via a .. (dot dot) in a table name.

References (15)

Core 15

Core References

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1397-1

Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT4435

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2010-0824.html

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10258

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7210

Mailing List vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html

Various Sources x_refsource_confirm

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-47.html

Patch x_refsource_misc

http://lists.mysql.com/commits/107532

Various Sources x_refsource_confirm

http://bugs.mysql.com/bug.php?id=53371

Various Sources x_refsource_confirm

http://dev.mysql.com/doc/refman/5.0/en/news-5-0-91.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2010-0442.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1024031

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2010:107

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html

Scores

EPSS 0.0312

EPSS Percentile 86.2%

Details

CWE

CWE-22

Status published

Products (50)

mysql/mysql 5.0.0

mysql/mysql 5.0.1

mysql/mysql 5.0.2

mysql/mysql 5.0.3

mysql/mysql 5.0.4

mysql/mysql 5.0.5

mysql/mysql 5.0.5.0.21

mysql/mysql 5.0.10

mysql/mysql 5.0.15

mysql/mysql 5.0.16

... and 40 more

Published Jun 08, 2010

Tracked Since Feb 18, 2026