CVE-2008-4456 (GCVE-0-2008-4456)

Vulnerability from cvelistv5 – Published: 2008-10-06 23:00 – Updated: 2024-08-07 10:17
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securityfocus.com/archive/1/497885/100… mailing-listx_refsource_BUGTRAQ
http://www.mandriva.com/security/advisories?name=… vendor-advisoryx_refsource_MANDRIVA
http://www.ubuntu.com/usn/USN-1397-1 vendor-advisoryx_refsource_UBUNTU
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
https://oval.cisecurity.org/repository/search/def… vdb-entrysignaturex_refsource_OVAL
http://www.securityfocus.com/archive/1/497158/100… mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/38517 third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2009/dsa-1783 vendor-advisoryx_refsource_DEBIAN
http://bugs.mysql.com/bug.php?id=27884 x_refsource_CONFIRM
http://ubuntu.com/usn/usn-897-1 vendor-advisoryx_refsource_UBUNTU
http://www.redhat.com/support/errata/RHSA-2009-12… vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/32072 third-party-advisoryx_refsource_SECUNIA
http://lists.apple.com/archives/security-announce… vendor-advisoryx_refsource_APPLE
http://www.securityfocus.com/archive/1/496842/100… mailing-listx_refsource_BUGTRAQ
http://support.apple.com/kb/HT4077 x_refsource_CONFIRM
http://www.redhat.com/support/errata/RHSA-2010-01… vendor-advisoryx_refsource_REDHAT
http://www.henlich.de/it-security/mysql-command-l… x_refsource_MISC
http://seclists.org/bugtraq/2008/Oct/0026.html mailing-listx_refsource_BUGTRAQ
http://securityreason.com/securityalert/4357 third-party-advisoryx_refsource_SREASON
http://secunia.com/advisories/34907 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/archive/1/496877/100… mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/36566 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/31486 vdb-entryx_refsource_BID
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T10:17:09.714Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20081029 Re: MySQL command-line client HTML injection vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/497885/100/0/threaded"
          },
          {
            "name": "MDVSA-2009:094",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:094"
          },
          {
            "name": "USN-1397-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1397-1"
          },
          {
            "name": "mysql-commandline-xss(45590)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45590"
          },
          {
            "name": "oval:org.mitre.oval:def:11456",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11456"
          },
          {
            "name": "20081008 Re: MySQL command-line client HTML injection vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/497158/100/0/threaded"
          },
          {
            "name": "38517",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38517"
          },
          {
            "name": "DSA-1783",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1783"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.mysql.com/bug.php?id=27884"
          },
          {
            "name": "USN-897-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://ubuntu.com/usn/usn-897-1"
          },
          {
            "name": "RHSA-2009:1289",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2009-1289.html"
          },
          {
            "name": "32072",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32072"
          },
          {
            "name": "APPLE-SA-2010-03-29-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
          },
          {
            "name": "20080930 MySQL command-line client HTML injection vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/496842/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT4077"
          },
          {
            "name": "RHSA-2010:0110",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0110.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability"
          },
          {
            "name": "20081004 RE: RE: MySQL command-line client HTML injection vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://seclists.org/bugtraq/2008/Oct/0026.html"
          },
          {
            "name": "4357",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4357"
          },
          {
            "name": "34907",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34907"
          },
          {
            "name": "20080930 RE: MySQL command-line client HTML injection vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/496877/100/0/threaded"
          },
          {
            "name": "36566",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36566"
          },
          {
            "name": "31486",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/31486"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-09-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document.  NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20081029 Re: MySQL command-line client HTML injection vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/497885/100/0/threaded"
        },
        {
          "name": "MDVSA-2009:094",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:094"
        },
        {
          "name": "USN-1397-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1397-1"
        },
        {
          "name": "mysql-commandline-xss(45590)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45590"
        },
        {
          "name": "oval:org.mitre.oval:def:11456",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11456"
        },
        {
          "name": "20081008 Re: MySQL command-line client HTML injection vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/497158/100/0/threaded"
        },
        {
          "name": "38517",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38517"
        },
        {
          "name": "DSA-1783",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1783"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.mysql.com/bug.php?id=27884"
        },
        {
          "name": "USN-897-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://ubuntu.com/usn/usn-897-1"
        },
        {
          "name": "RHSA-2009:1289",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2009-1289.html"
        },
        {
          "name": "32072",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32072"
        },
        {
          "name": "APPLE-SA-2010-03-29-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
        },
        {
          "name": "20080930 MySQL command-line client HTML injection vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/496842/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT4077"
        },
        {
          "name": "RHSA-2010:0110",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2010-0110.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability"
        },
        {
          "name": "20081004 RE: RE: MySQL command-line client HTML injection vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://seclists.org/bugtraq/2008/Oct/0026.html"
        },
        {
          "name": "4357",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4357"
        },
        {
          "name": "34907",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34907"
        },
        {
          "name": "20080930 RE: MySQL command-line client HTML injection vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/496877/100/0/threaded"
        },
        {
          "name": "36566",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36566"
        },
        {
          "name": "31486",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/31486"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-4456",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document.  NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20081029 Re: MySQL command-line client HTML injection vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/497885/100/0/threaded"
            },
            {
              "name": "MDVSA-2009:094",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:094"
            },
            {
              "name": "USN-1397-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1397-1"
            },
            {
              "name": "mysql-commandline-xss(45590)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45590"
            },
            {
              "name": "oval:org.mitre.oval:def:11456",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11456"
            },
            {
              "name": "20081008 Re: MySQL command-line client HTML injection vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/497158/100/0/threaded"
            },
            {
              "name": "38517",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38517"
            },
            {
              "name": "DSA-1783",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2009/dsa-1783"
            },
            {
              "name": "http://bugs.mysql.com/bug.php?id=27884",
              "refsource": "CONFIRM",
              "url": "http://bugs.mysql.com/bug.php?id=27884"
            },
            {
              "name": "USN-897-1",
              "refsource": "UBUNTU",
              "url": "http://ubuntu.com/usn/usn-897-1"
            },
            {
              "name": "RHSA-2009:1289",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2009-1289.html"
            },
            {
              "name": "32072",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32072"
            },
            {
              "name": "APPLE-SA-2010-03-29-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
            },
            {
              "name": "20080930 MySQL command-line client HTML injection vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/496842/100/0/threaded"
            },
            {
              "name": "http://support.apple.com/kb/HT4077",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT4077"
            },
            {
              "name": "RHSA-2010:0110",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2010-0110.html"
            },
            {
              "name": "http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability",
              "refsource": "MISC",
              "url": "http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability"
            },
            {
              "name": "20081004 RE: RE: MySQL command-line client HTML injection vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://seclists.org/bugtraq/2008/Oct/0026.html"
            },
            {
              "name": "4357",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4357"
            },
            {
              "name": "34907",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34907"
            },
            {
              "name": "20080930 RE: MySQL command-line client HTML injection vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/496877/100/0/threaded"
            },
            {
              "name": "36566",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36566"
            },
            {
              "name": "31486",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/31486"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-4456",
    "datePublished": "2008-10-06T23:00:00",
    "dateReserved": "2008-10-06T00:00:00",
    "dateUpdated": "2024-08-07T10:17:09.714Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"754B78F2-A03C-40BE-812B-F5E57B93D20B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mysql:mysql:5.0.30:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BEF9271A-A816-44F6-A811-ECC1FB0993C5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mysql:mysql:5.0.36:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F482D3D3-205C-495E-AF3A-E9C3018111F7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mysql:mysql:5.0.44:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"53853D65-F2C6-410F-9CF8-DED19B66BD4E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:5.0.26:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"811780EA-8805-41A6-A920-A201CCC80790\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:5.0.27:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"11873AEA-5D6C-4AC0-915A-8A2869B2EFF5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:5.0.30:sp1:*:*:*:*:*:*\", \"matchCriteriaId\": \"A7753CE5-61C4-4FBC-BB60-F7D4493E76E3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:5.0.32:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7EDC2EB4-2C8D-4EF7-83A6-CBE6FF759DD0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:5.0.33:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5965032E-5BC0-4E69-B097-F9EE2B24C861\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:5.0.37:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"35F21A5A-F9C0-4860-80AD-1D3937483F28\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:5.0.38:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B54F660F-AE43-4F3B-8935-5712CAE860A9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:5.0.41:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4413BB52-6FBD-4C12-8864-ADDC65E45B25\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:5.0.42:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B49F9BA-560B-40AE-9457-436830CDD371\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:5.0.45:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F53A8437-C61A-4203-B341-B5596569E50B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:5.0.67:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C98C5EFF-B629-4FFF-B535-0C25DADD1C25\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document.  NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el cliente command-line en MySQL v5.0.26 a la v5.0.45, cuando la opci\\u00f3n --html est\\u00e1 activa, permite a los atacantes inyectar web script o HTML de su elecci\\u00f3n coloc\\u00e1ndolo en una celda de la base de datos, a la que puede acceder el cliente al comoponer un documento HTML.\"}]",
      "id": "CVE-2008-4456",
      "lastModified": "2024-11-21T00:51:43.277",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:H/Au:N/C:N/I:P/A:N\", \"baseScore\": 2.6, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"HIGH\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 4.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2008-10-06T23:25:50.707",
      "references": "[{\"url\": \"http://bugs.mysql.com/bug.php?id=27884\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\"]}, {\"url\": \"http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://seclists.org/bugtraq/2008/Oct/0026.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/32072\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/34907\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/36566\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/38517\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://securityreason.com/securityalert/4357\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://support.apple.com/kb/HT4077\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://ubuntu.com/usn/usn-897-1\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.debian.org/security/2009/dsa-1783\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.mandriva.com/security/advisories?name=MDVSA-2009:094\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2009-1289.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2010-0110.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/archive/1/496842/100/0/threaded\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/archive/1/496877/100/0/threaded\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/archive/1/497158/100/0/threaded\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/archive/1/497885/100/0/threaded\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/31486\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.ubuntu.com/usn/USN-1397-1\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/45590\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11456\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://bugs.mysql.com/bug.php?id=27884\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\"]}, {\"url\": \"http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://seclists.org/bugtraq/2008/Oct/0026.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/32072\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/34907\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/36566\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/38517\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://securityreason.com/securityalert/4357\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://support.apple.com/kb/HT4077\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://ubuntu.com/usn/usn-897-1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.debian.org/security/2009/dsa-1783\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.mandriva.com/security/advisories?name=MDVSA-2009:094\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2009-1289.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2010-0110.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/archive/1/496842/100/0/threaded\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/archive/1/496877/100/0/threaded\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/archive/1/497158/100/0/threaded\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/archive/1/497885/100/0/threaded\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/31486\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.ubuntu.com/usn/USN-1397-1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/45590\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11456\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vendorComments": "[{\"organization\": \"Red Hat\", \"comment\": \"Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-4456\\n\\nThis issue was addressed for Red Hat Enterprise Linux 5 by https://rhn.redhat.com/errata/RHSA-2009-1289.html and Red Hat Enterprise Linux 4 by https://rhn.redhat.com/errata/RHSA-2010-0110.html .\\n\\nThe Red Hat Security Response Team has rated this issue as having low security impact, future MySQL package updates may address this flaw for Red Hat Enterprise Linux 3, and Red Hat Application Stack 2.\", \"lastModified\": \"2010-02-17T00:00:00\"}]",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2008-4456\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2008-10-06T23:25:50.707\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document.  NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el cliente command-line en MySQL v5.0.26 a la v5.0.45, cuando la opci\u00f3n --html est\u00e1 activa, permite a los atacantes inyectar web script o HTML de su elecci\u00f3n coloc\u00e1ndolo en una celda de la base de datos, a la que puede acceder el cliente al comoponer un documento HTML.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:H/Au:N/C:N/I:P/A:N\",\"baseScore\":2.6,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"HIGH\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":4.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"754B78F2-A03C-40BE-812B-F5E57B93D20B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mysql:mysql:5.0.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BEF9271A-A816-44F6-A811-ECC1FB0993C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mysql:mysql:5.0.36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F482D3D3-205C-495E-AF3A-E9C3018111F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mysql:mysql:5.0.44:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"53853D65-F2C6-410F-9CF8-DED19B66BD4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:5.0.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"811780EA-8805-41A6-A920-A201CCC80790\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:5.0.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11873AEA-5D6C-4AC0-915A-8A2869B2EFF5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:5.0.30:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7753CE5-61C4-4FBC-BB60-F7D4493E76E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:5.0.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7EDC2EB4-2C8D-4EF7-83A6-CBE6FF759DD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:5.0.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5965032E-5BC0-4E69-B097-F9EE2B24C861\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:5.0.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"35F21A5A-F9C0-4860-80AD-1D3937483F28\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:5.0.38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B54F660F-AE43-4F3B-8935-5712CAE860A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:5.0.41:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4413BB52-6FBD-4C12-8864-ADDC65E45B25\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:5.0.42:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B49F9BA-560B-40AE-9457-436830CDD371\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:5.0.45:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F53A8437-C61A-4203-B341-B5596569E50B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:5.0.67:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C98C5EFF-B629-4FFF-B535-0C25DADD1C25\"}]}]}],\"references\":[{\"url\":\"http://bugs.mysql.com/bug.php?id=27884\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\"]},{\"url\":\"http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://seclists.org/bugtraq/2008/Oct/0026.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/32072\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/34907\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/36566\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/38517\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://securityreason.com/securityalert/4357\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://support.apple.com/kb/HT4077\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://ubuntu.com/usn/usn-897-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2009/dsa-1783\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2009:094\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2009-1289.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2010-0110.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/496842/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/496877/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/497158/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/497885/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/31486\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ubuntu.com/usn/USN-1397-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/45590\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11456\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://bugs.mysql.com/bug.php?id=27884\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://seclists.org/bugtraq/2008/Oct/0026.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/32072\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/34907\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/36566\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/38517\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://securityreason.com/securityalert/4357\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://support.apple.com/kb/HT4077\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://ubuntu.com/usn/usn-897-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2009/dsa-1783\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2009:094\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2009-1289.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2010-0110.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/496842/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/496877/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/497158/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/497885/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/31486\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-1397-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/45590\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11456\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"vendorComments\":[{\"organization\":\"Red Hat\",\"comment\":\"Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-4456\\n\\nThis issue was addressed for Red Hat Enterprise Linux 5 by https://rhn.redhat.com/errata/RHSA-2009-1289.html and Red Hat Enterprise Linux 4 by https://rhn.redhat.com/errata/RHSA-2010-0110.html .\\n\\nThe Red Hat Security Response Team has rated this issue as having low security impact, future MySQL package updates may address this flaw for Red Hat Enterprise Linux 3, and Red Hat Application Stack 2.\",\"lastModified\":\"2010-02-17T00:00:00\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.