Read the docs
TI-2002-01297 Aliases CVE-2002-1374GHSA-rf99-cxf6-755h

The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows…

Priority MEDIUM 52Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.

Why it matters now

EPSS 0.20451 97th percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 62

CPEVersionsRoleVendor
cpe:2.3:a:oracle:mysql:3.22.26:*:*:*:*:*:*:*3.22.26VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.27:*:*:*:*:*:*:*3.22.27VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.28:*:*:*:*:*:*:*3.22.28VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.29:*:*:*:*:*:*:*3.22.29VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.30:*:*:*:*:*:*:*3.22.30VulnerableOracle
cpe:2.3:a:oracle:mysql:3.22.32:*:*:*:*:*:*:*3.22.32VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.2:*:*:*:*:*:*:*3.23.2VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.3:*:*:*:*:*:*:*3.23.3VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.4:*:*:*:*:*:*:*3.23.4VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.5:*:*:*:*:*:*:*3.23.5VulnerableOracle
  • cpe:2.3:a:oracle:mysql:3.22.26:*:*:*:*:*:*:* Versions 3.22.26 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.27:*:*:*:*:*:*:* Versions 3.22.27 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.28:*:*:*:*:*:*:* Versions 3.22.28 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.29:*:*:*:*:*:*:* Versions 3.22.29 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.30:*:*:*:*:*:*:* Versions 3.22.30 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.22.32:*:*:*:*:*:*:* Versions 3.22.32 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.2:*:*:*:*:*:*:* Versions 3.23.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.3:*:*:*:*:*:*:* Versions 3.23.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.4:*:*:*:*:*:*:* Versions 3.23.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.5:*:*:*:*:*:*:* Versions 3.23.5 Vulnerable ·Oracle
Show 52 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:mysql:3.23.8:*:*:*:*:*:*:*3.23.8VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.9:*:*:*:*:*:*:*3.23.9VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.10:*:*:*:*:*:*:*3.23.10VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.23:*:*:*:*:*:*:*3.23.23VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.24:*:*:*:*:*:*:*3.23.24VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.25:*:*:*:*:*:*:*3.23.25VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.26:*:*:*:*:*:*:*3.23.26VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.27:*:*:*:*:*:*:*3.23.27VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.28:*:*:*:*:*:*:*3.23.28VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.29:*:*:*:*:*:*:*3.23.29VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.30:*:*:*:*:*:*:*3.23.30VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.31:*:*:*:*:*:*:*3.23.31VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.34:*:*:*:*:*:*:*3.23.34VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.36:*:*:*:*:*:*:*3.23.36VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.37:*:*:*:*:*:*:*3.23.37VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.38:*:*:*:*:*:*:*3.23.38VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.39:*:*:*:*:*:*:*3.23.39VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.40:*:*:*:*:*:*:*3.23.40VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.41:*:*:*:*:*:*:*3.23.41VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.42:*:*:*:*:*:*:*3.23.42VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.43:*:*:*:*:*:*:*3.23.43VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.44:*:*:*:*:*:*:*3.23.44VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.45:*:*:*:*:*:*:*3.23.45VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.46:*:*:*:*:*:*:*3.23.46VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.47:*:*:*:*:*:*:*3.23.47VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.48:*:*:*:*:*:*:*3.23.48VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.49:*:*:*:*:*:*:*3.23.49VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.50:*:*:*:*:*:*:*3.23.50VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.51:*:*:*:*:*:*:*3.23.51VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.52:*:*:*:*:*:*:*3.23.52VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.53:*:*:*:*:*:*:*3.23.53VulnerableOracle
cpe:2.3:a:oracle:mysql:3.23.53a:*:*:*:*:*:*:*3.23.53aVulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.2:*:*:*:*:*:*:*4.0.2VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.3:*:*:*:*:*:*:*4.0.3VulnerableOracle
cpe:2.3:a:oracle:mysql:4.0.5a:*:*:*:*:*:*:*4.0.5aVulnerableOracle
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:3.4:*:*:*:*:*:*:*3.4VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5:*:*:*:*:*:*:*4.5VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp1:*:*:*:*:*:*:*4.5_fp1VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp2:*:*:*:*:*:*:*4.5_fp2VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp3:*:*:*:*:*:*:*4.5_fp3VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp1:*:*:*:*:*:*:*4.5_mp1VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp2:*:*:*:*:*:*:*4.5_mp2VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp3:*:*:*:*:*:*:*4.5_mp3VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5:*:*:*:*:*:*:*4.5VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp1:*:*:*:*:*:*:*4.5_fp1VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp2:*:*:*:*:*:*:*4.5_fp2VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp3:*:*:*:*:*:*:*4.5_fp3VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp1:*:*:*:*:*:*:*4.5_mp1VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp2:*:*:*:*:*:*:*4.5_mp2VulnerableSymantec Veritas
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp3:*:*:*:*:*:*:*4.5_mp3VulnerableSymantec Veritas
  • cpe:2.3:a:oracle:mysql:3.23.8:*:*:*:*:*:*:* Versions 3.23.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.9:*:*:*:*:*:*:* Versions 3.23.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.10:*:*:*:*:*:*:* Versions 3.23.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.23:*:*:*:*:*:*:* Versions 3.23.23 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.24:*:*:*:*:*:*:* Versions 3.23.24 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.25:*:*:*:*:*:*:* Versions 3.23.25 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.26:*:*:*:*:*:*:* Versions 3.23.26 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.27:*:*:*:*:*:*:* Versions 3.23.27 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.28:*:*:*:*:*:*:* Versions 3.23.28 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.29:*:*:*:*:*:*:* Versions 3.23.29 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.30:*:*:*:*:*:*:* Versions 3.23.30 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.31:*:*:*:*:*:*:* Versions 3.23.31 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.34:*:*:*:*:*:*:* Versions 3.23.34 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.36:*:*:*:*:*:*:* Versions 3.23.36 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.37:*:*:*:*:*:*:* Versions 3.23.37 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.38:*:*:*:*:*:*:* Versions 3.23.38 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.39:*:*:*:*:*:*:* Versions 3.23.39 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.40:*:*:*:*:*:*:* Versions 3.23.40 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.41:*:*:*:*:*:*:* Versions 3.23.41 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.42:*:*:*:*:*:*:* Versions 3.23.42 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.43:*:*:*:*:*:*:* Versions 3.23.43 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.44:*:*:*:*:*:*:* Versions 3.23.44 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.45:*:*:*:*:*:*:* Versions 3.23.45 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.46:*:*:*:*:*:*:* Versions 3.23.46 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.47:*:*:*:*:*:*:* Versions 3.23.47 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.48:*:*:*:*:*:*:* Versions 3.23.48 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.49:*:*:*:*:*:*:* Versions 3.23.49 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.50:*:*:*:*:*:*:* Versions 3.23.50 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.51:*:*:*:*:*:*:* Versions 3.23.51 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.52:*:*:*:*:*:*:* Versions 3.23.52 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.53:*:*:*:*:*:*:* Versions 3.23.53 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:3.23.53a:*:*:*:*:*:*:* Versions 3.23.53a Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:4.0.5a:*:*:*:*:*:*:* Versions 4.0.5a Vulnerable ·Oracle
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp1:*:*:*:*:*:*:* Versions 4.5_fp1 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp2:*:*:*:*:*:*:* Versions 4.5_fp2 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp3:*:*:*:*:*:*:* Versions 4.5_fp3 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp1:*:*:*:*:*:*:* Versions 4.5_mp1 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp2:*:*:*:*:*:*:* Versions 4.5_mp2 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp3:*:*:*:*:*:*:* Versions 4.5_mp3 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp1:*:*:*:*:*:*:* Versions 4.5_fp1 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp2:*:*:*:*:*:*:* Versions 4.5_fp2 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp3:*:*:*:*:*:*:* Versions 4.5_fp3 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp1:*:*:*:*:*:*:* Versions 4.5_mp1 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp2:*:*:*:*:*:*:* Versions 4.5_mp2 Vulnerable ·Symantec Veritas
  • cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp3:*:*:*:*:*:*:* Versions 4.5_mp3 Vulnerable ·Symantec Veritas

Remediation

Red Hat 3 advisories

  • RHSA-2003:166 Released 2003-05-15 · Red Hat rating Important
    : : : Updated MySQL packages fix vulnerabilities
    • Red Hat Linux 7.1
  • RHSA-2002:288 Released 2003-01-15 · Red Hat rating Important
    : Updated MySQL packages fix various security issues
    • Red Hat Linux 7.0
    • Red Hat Linux 7.1
    • Red Hat Linux 7.2
    • Red Hat Linux 7.3
    • Red Hat Linux 8.0
  • RHSA-2002:289 Released 2003-01-06 · Red Hat rating Important
    mysql security update
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1
    • Red Hat Linux Advanced Workstation 2.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Fixed RHSA-2002:289
Red Hat Linux 7.0Fixed RHSA-2002:288
Red Hat Linux 7.1Fixed RHSA-2002:288
Red Hat Linux 7.2Fixed RHSA-2002:288
Red Hat Linux 7.3Fixed RHSA-2002:288
Red Hat Linux 8.0Fixed RHSA-2002:288
Red Hat Linux Advanced Workstation 2.1Fixed RHSA-2002:289

Timeline

  1. 2026-10-02 Threatist record created from CVE-2002-1374
  2. 2026-10-03 Alias added: GHSA-rf99-cxf6-755h

References

Patch 1

Advisory 9

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences