Description

Unknown vulnerability in MySQL 3.23.58 and earlier, when a local user has privileges for a database whose name includes a "_" (underscore), grants privileges to other databases that have similar names, which can allow the user to conduct unauthorized activities.

Remediation

References

CVE-2004-0957

Related Vulnerabilities

AbanteCart Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-42051)

ownCloud Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2013-1850)

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-17824)

WordPress Plugin Multiple Page Generator-MPG Cross-Site Request Forgery (3.3.9)

SugarCRM Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-6308)

Severity

Medium

Classification

CVE-2004-0957

Tags

Missing Update Known Vulnerabilities