CVE-2010-1848: Path Traversal

Published Jun 7, 2010

Updated

Directory traversal vulnerability in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to bypass intended table grants to read field definitions of arbitrary tables, and on 5.1 to read or delete content of arbitrary tables, via a .. (dot dot) in a table name.

Affected Software

85 affected components

MySQL mysql=5.0.0

MySQL mysql=5.0.1

MySQL mysql=5.0.2

MySQL mysql=5.0.3

MySQL mysql=5.0.4

MySQL mysql=5.0.5

MySQL mysql=5.0.5.0.21

MySQL mysql=5.0.10

MySQL mysql=5.0.15

MySQL mysql=5.0.16

MySQL mysql=5.0.17

MySQL mysql=5.0.20

MySQL mysql=5.0.24

MySQL mysql=5.0.45b

MySQL mysql=5.0.82

MySQL mysql=5.0.84

MySQL mysql=5.0.87

Oracle MySQL=5.0.0-alpha

Oracle MySQL=5.0.3-beta

Oracle MySQL=5.0.6

Oracle MySQL=5.0.7

Oracle MySQL=5.0.8

Oracle MySQL=5.0.9

Oracle MySQL=5.0.11

Oracle MySQL=5.0.12

Oracle MySQL=5.0.13

Oracle MySQL=5.0.14

Oracle MySQL=5.0.18

Oracle MySQL=5.0.19

Oracle MySQL=5.0.21

Oracle MySQL=5.0.22

Oracle MySQL=5.0.23

Oracle MySQL=5.0.27

Oracle MySQL=5.0.33

Oracle MySQL=5.0.37

Oracle MySQL=5.0.41

Oracle MySQL=5.0.45

Oracle MySQL=5.0.51

Oracle MySQL=5.0.67

Oracle MySQL=5.0.75

Oracle MySQL=5.0.77

Oracle MySQL=5.0.81

Oracle MySQL=5.0.83

Oracle MySQL=5.0.85

Oracle MySQL=5.0.86

Oracle MySQL=5.0.88

Oracle MySQL=5.0.89

Oracle MySQL=5.0.90

Oracle MySQL=5.0.91

MySQL mysql=5.1.5

MySQL mysql=5.1.23

MySQL mysql=5.1.31

MySQL mysql=5.1.32

MySQL mysql=5.1.34

MySQL mysql=5.1.37

Oracle MySQL=5.1

Oracle MySQL=5.1.1

Oracle MySQL=5.1.2

Oracle MySQL=5.1.3

Oracle MySQL=5.1.4

Oracle MySQL=5.1.6

Oracle MySQL=5.1.7

Oracle MySQL=5.1.8

Oracle MySQL=5.1.9

Oracle MySQL=5.1.10

Oracle MySQL=5.1.11

Oracle MySQL=5.1.12

Oracle MySQL=5.1.13

Oracle MySQL=5.1.14

Oracle MySQL=5.1.15

Oracle MySQL=5.1.16

Oracle MySQL=5.1.17

Oracle MySQL=5.1.30

Oracle MySQL=5.1.33

Oracle MySQL=5.1.35

Oracle MySQL=5.1.36

Oracle MySQL=5.1.38

Oracle MySQL=5.1.39

Oracle MySQL=5.1.40

Oracle MySQL=5.1.41

Oracle MySQL=5.1.42

Oracle MySQL=5.1.43

Oracle MySQL=5.1.44

Oracle MySQL=5.1.45

Oracle MySQL=5.1.46

Event History

Jun 7, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Jun 8, 2010

Data Sourced

via NVD·12:30 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-1848?

CVE-2010-1848 is considered a high severity vulnerability due to its potential for unauthorized data access.

How do I fix CVE-2010-1848?

To fix CVE-2010-1848, upgrade MySQL to version 5.1.47 or later which addresses the directory traversal issue.

What are the affected MySQL versions in CVE-2010-1848?

CVE-2010-1848 affects MySQL versions 5.0.0 through 5.0.91 and all versions before 5.1.47.

Can a remote attacker exploit CVE-2010-1848?

Yes, a remote authenticated user can exploit CVE-2010-1848 to bypass table grants and access unauthorized data.

What types of data can be accessed due to CVE-2010-1848?

Exploitation of CVE-2010-1848 allows attackers to read field definitions and, in some versions, manipulate arbitrary table content.