CVE-2008-4456

2008-10-0623:25:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2008-4456

xss

mysql 5.0

command-line client

security vulnerability

5.2 Medium

AI Score

Confidence

High

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

0.014 Low

EPSS

Percentile

86.1%

JSON

Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.

CPENameOperatorVersion
mysql:mysqlmysqleq5.0.44
mysql:mysqlmysqleq5.0.30
mysql:mysqlmysqleq5.0.4
mysql:mysqlmysqleq5.0.36
oracle:mysqloracle mysqleq5.0.26
oracle:mysqloracle mysqleq5.0.27
oracle:mysqloracle mysqleq5.0.30
oracle:mysqloracle mysqleq5.0.32
oracle:mysqloracle mysqleq5.0.33
oracle:mysqloracle mysqleq5.0.37

CPE	Name	Operator	Version
mysql:mysql	mysql	eq	5.0.44
mysql:mysql	mysql	eq	5.0.30
mysql:mysql	mysql	eq	5.0.4
mysql:mysql	mysql	eq	5.0.36
oracle:mysql	oracle mysql	eq	5.0.26
oracle:mysql	oracle mysql	eq	5.0.27
oracle:mysql	oracle mysql	eq	5.0.30
oracle:mysql	oracle mysql	eq	5.0.32
oracle:mysql	oracle mysql	eq	5.0.33
oracle:mysql	oracle mysql	eq	5.0.37