The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.

Threat-Mapped Scoring

Score: 3.25

Priority: P2 - Serious (High)

• S1 – Steal Customer Account Information
• S9 – Sabotage of System/App (+0.25 bonus)

EPSS

Score: 0.25364
Percentile: 0.95956

CVSS Scoring

Affected Products

• cpe:2.3:a:oracle:mysql:3.22.26:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.22.27:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.22.28:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.22.29:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.22.30:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.22.32:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.2:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.3:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.4:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.5:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.8:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.9:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.10:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.23:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.24:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.25:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.26:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.27:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.28:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.29:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.30:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.31:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.34:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.36:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.37:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.38:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.39:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.40:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.41:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.42:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.43:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.44:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.45:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.46:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.47:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.48:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.49:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.50:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.51:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.52:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.53:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:3.23.53a:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:4.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:4.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:4.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:4.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:mysql:4.0.5a:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:3.4:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp1:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp2:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp3:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp1:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp2:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp3:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp1:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp2:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp3:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp1:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp2:*:*:*:*:*:*:*
• cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp3:*:*:*:*:*:*:*

← Back to Home