6.5

CVE-2010-1848

Directory traversal vulnerability in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to bypass intended table grants to read field definitions of arbitrary tables, and on 5.1 to read or delete content of arbitrary tables, via a .. (dot dot) in a table name.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mysql ≫ Mysql Version5.0.0
Mysql ≫ Mysql Version5.0.1
Mysql ≫ Mysql Version5.0.2
Mysql ≫ Mysql Version5.0.3
Mysql ≫ Mysql Version5.0.4
Mysql ≫ Mysql Version5.0.5
Mysql ≫ Mysql Version5.0.5.0.21
Mysql ≫ Mysql Version5.0.10
Mysql ≫ Mysql Version5.0.15
Mysql ≫ Mysql Version5.0.16
Mysql ≫ Mysql Version5.0.17
Mysql ≫ Mysql Version5.0.20
Mysql ≫ Mysql Version5.0.24
Mysql ≫ Mysql Version5.0.45b
Mysql ≫ Mysql Version5.0.82
Mysql ≫ Mysql Version5.0.84
Mysql ≫ Mysql Version5.0.87
Oracle ≫ Mysql Version5.0.0 Updatealpha
Oracle ≫ Mysql Version5.0.3 Updatebeta
Oracle ≫ Mysql Version5.0.6
Oracle ≫ Mysql Version5.0.7
Oracle ≫ Mysql Version5.0.8
Oracle ≫ Mysql Version5.0.9
Oracle ≫ Mysql Version5.0.11
Oracle ≫ Mysql Version5.0.12
Oracle ≫ Mysql Version5.0.13
Oracle ≫ Mysql Version5.0.14
Oracle ≫ Mysql Version5.0.18
Oracle ≫ Mysql Version5.0.19
Oracle ≫ Mysql Version5.0.21
Oracle ≫ Mysql Version5.0.22
Oracle ≫ Mysql Version5.0.23
Oracle ≫ Mysql Version5.0.27
Oracle ≫ Mysql Version5.0.33
Oracle ≫ Mysql Version5.0.37
Oracle ≫ Mysql Version5.0.41
Oracle ≫ Mysql Version5.0.45
Oracle ≫ Mysql Version5.0.51
Oracle ≫ Mysql Version5.0.67
Oracle ≫ Mysql Version5.0.75
Oracle ≫ Mysql Version5.0.77
Oracle ≫ Mysql Version5.0.81
Oracle ≫ Mysql Version5.0.83
Oracle ≫ Mysql Version5.0.85
Oracle ≫ Mysql Version5.0.86
Oracle ≫ Mysql Version5.0.88
Oracle ≫ Mysql Version5.0.89
Oracle ≫ Mysql Version5.0.90
Oracle ≫ Mysql Version5.0.91
Mysql ≫ Mysql Version5.1.5
Mysql ≫ Mysql Version5.1.23
Mysql ≫ Mysql Version5.1.31
Mysql ≫ Mysql Version5.1.32
Mysql ≫ Mysql Version5.1.34
Mysql ≫ Mysql Version5.1.37
Oracle ≫ Mysql Version5.1
Oracle ≫ Mysql Version5.1.1
Oracle ≫ Mysql Version5.1.2
Oracle ≫ Mysql Version5.1.3
Oracle ≫ Mysql Version5.1.4
Oracle ≫ Mysql Version5.1.6
Oracle ≫ Mysql Version5.1.7
Oracle ≫ Mysql Version5.1.8
Oracle ≫ Mysql Version5.1.9
Oracle ≫ Mysql Version5.1.10
Oracle ≫ Mysql Version5.1.11
Oracle ≫ Mysql Version5.1.12
Oracle ≫ Mysql Version5.1.13
Oracle ≫ Mysql Version5.1.14
Oracle ≫ Mysql Version5.1.15
Oracle ≫ Mysql Version5.1.16
Oracle ≫ Mysql Version5.1.17
Oracle ≫ Mysql Version5.1.30
Oracle ≫ Mysql Version5.1.33
Oracle ≫ Mysql Version5.1.35
Oracle ≫ Mysql Version5.1.36
Oracle ≫ Mysql Version5.1.38
Oracle ≫ Mysql Version5.1.39
Oracle ≫ Mysql Version5.1.40
Oracle ≫ Mysql Version5.1.41
Oracle ≫ Mysql Version5.1.42
Oracle ≫ Mysql Version5.1.43
Oracle ≫ Mysql Version5.1.44
Oracle ≫ Mysql Version5.1.45
Oracle ≫ Mysql Version5.1.46
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.12% 0.861
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

http://www.ubuntu.com/usn/USN-1397-1
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
http://support.apple.com/kb/HT4435
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html
http://www.redhat.com/support/errata/RHSA-2010-0442.html
http://bugs.mysql.com/bug.php?id=53371
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-91.html
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-47.html
http://lists.mysql.com/commits/107532
http://securitytracker.com/id?1024031
http://www.mandriva.com/security/advisories?name=MDVSA-2010:107
http://www.redhat.com/support/errata/RHSA-2010-0824.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10258
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7210