CVE-2008-2384

2009-01-2200:00:00

ubuntu.com

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

74.9%

JSON

SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka
libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when
configured to use a multibyte character set that allows a \ (backslash) as
part of the character encoding, allows remote attackers to execute
arbitrary SQL commands via unspecified inputs in a login request.

Notes

Author	Note
mdeslaur	Specifying an encoding was introduced by the 012-charset.dpatch patch in 4.3.9-10. Since we don’t support specifying an encoding mysql won’t decode the username and injection is not possible.