CVE-2008-7247

2009-11-3017:30:00

CWE-59

[email protected]

web.nvd.nist.gov

177

cve-2008-7247

mysql

data directory

index directory

symlink

security vulnerability

5.8 Medium

AI Score

Confidence

Low

6 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.0%

JSON

sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY argument referring to a subdirectory that requires following this symlink.

CPENameOperatorVersion
mysql:mysqlmysqleq5.0.5
mysql:mysqlmysqleq5.0.10
mysql:mysqlmysqleq5.0.54
mysql:mysqlmysqleq5.0.0
mysql:mysqlmysqleq5.1.23
mysql:mysqlmysqleq5.0.15
mysql:mysqlmysqleq5.0.17
mysql:mysqlmysqleq5.0.5.0.21
mysql:mysqlmysqleq5.0.3
mysql:mysqlmysqleq5.0.44

CPE	Name	Operator	Version
mysql:mysql	mysql	eq	5.0.5
mysql:mysql	mysql	eq	5.0.10
mysql:mysql	mysql	eq	5.0.54
mysql:mysql	mysql	eq	5.0.0
mysql:mysql	mysql	eq	5.1.23
mysql:mysql	mysql	eq	5.0.15
mysql:mysql	mysql	eq	5.0.17
mysql:mysql	mysql	eq	5.0.5.0.21
mysql:mysql	mysql	eq	5.0.3
mysql:mysql	mysql	eq	5.0.44