Read the docs
TI-2008-03932 Aliases CVE-2008-4098GHSA-cwr2-c5mc-rxv6

MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling…

Priority LOW 25CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.

Why it matters now

EPSS 0.01624 76th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 52

CPEVersionsRoleVendor
cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*6.06VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*7.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*8.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*8.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*9.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*9.10VulnerableCanonical
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*5.0VulnerableDebian
cpe:2.3:a:mysql:mysql:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.2:*:*:*:*:*:*:*5.0.2VulnerableMysql
  • cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:* Versions 6.06 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:* Versions 7.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:* Versions 8.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:* Versions 8.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:* Versions 9.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:* Versions 9.10 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Debian
  • cpe:2.3:a:mysql:mysql:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.2:*:*:*:*:*:*:* Versions 5.0.2 Vulnerable ·Mysql
Show 42 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:mysql:mysql:5.0.3:*:*:*:*:*:*:*5.0.3VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:*5.0.4VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.5:*:*:*:*:*:*:*5.0.5VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.10:*:*:*:*:*:*:*5.0.10VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.15:*:*:*:*:*:*:*5.0.15VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.16:*:*:*:*:*:*:*5.0.16VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.17:*:*:*:*:*:*:*5.0.17VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.20:*:*:*:*:*:*:*5.0.20VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.24:*:*:*:*:*:*:*5.0.24VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.30:*:*:*:*:*:*:*5.0.30VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.36:*:*:*:*:*:*:*5.0.36VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.44:*:*:*:*:*:*:*5.0.44VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.54:*:*:*:*:*:*:*5.0.54VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.56:*:*:*:*:*:*:*5.0.56VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.60:*:*:*:*:*:*:*5.0.60VulnerableMysql
cpe:2.3:a:mysql:mysql:5.0.66:*:*:*:*:*:*:*5.0.66VulnerableMysql
cpe:2.3:a:oracle:mysql:5.0.23:*:*:*:*:*:*:*5.0.23VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.25:*:*:*:*:*:*:*5.0.25VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.26:*:*:*:*:*:*:*5.0.26VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.28:*:*:*:*:*:*:*5.0.28VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.30:sp1:*:*:*:*:*:*5.0.30 sp1VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.32:*:*:*:*:*:*:*5.0.32VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.34:*:*:*:*:*:*:*5.0.34VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.36:sp1:*:*:*:*:*:*5.0.36 sp1VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.38:*:*:*:*:*:*:*5.0.38VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.40:*:*:*:*:*:*:*5.0.40VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.41:*:*:*:*:*:*:*5.0.41VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.42:*:*:*:*:*:*:*5.0.42VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.44:sp1:*:*:*:*:*:*5.0.44 sp1VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.45:*:*:*:*:*:*:*5.0.45VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.46:*:*:*:*:*:*:*5.0.46VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.48:*:*:*:*:*:*:*5.0.48VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.50:*:*:*:*:*:*:*5.0.50VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.50:sp1:*:*:*:*:*:*5.0.50 sp1VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.51:*:*:*:*:*:*:*5.0.51VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.52:*:*:*:*:*:*:*5.0.52VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.56:sp1:*:*:*:*:*:*5.0.56 sp1VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.58:*:*:*:*:*:*:*5.0.58VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.60:sp1:*:*:*:*:*:*5.0.60 sp1VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.62:*:*:*:*:*:*:*5.0.62VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.64:*:*:*:*:*:*:*5.0.64VulnerableOracle
cpe:2.3:a:oracle:mysql:5.0.66:sp1:*:*:*:*:*:*5.0.66 sp1VulnerableOracle
  • cpe:2.3:a:mysql:mysql:5.0.3:*:*:*:*:*:*:* Versions 5.0.3 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:* Versions 5.0.4 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.5:*:*:*:*:*:*:* Versions 5.0.5 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.10:*:*:*:*:*:*:* Versions 5.0.10 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.15:*:*:*:*:*:*:* Versions 5.0.15 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.16:*:*:*:*:*:*:* Versions 5.0.16 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.17:*:*:*:*:*:*:* Versions 5.0.17 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.20:*:*:*:*:*:*:* Versions 5.0.20 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.24:*:*:*:*:*:*:* Versions 5.0.24 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.30:*:*:*:*:*:*:* Versions 5.0.30 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.36:*:*:*:*:*:*:* Versions 5.0.36 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.44:*:*:*:*:*:*:* Versions 5.0.44 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.54:*:*:*:*:*:*:* Versions 5.0.54 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.56:*:*:*:*:*:*:* Versions 5.0.56 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.60:*:*:*:*:*:*:* Versions 5.0.60 Vulnerable ·Mysql
  • cpe:2.3:a:mysql:mysql:5.0.66:*:*:*:*:*:*:* Versions 5.0.66 Vulnerable ·Mysql
  • cpe:2.3:a:oracle:mysql:5.0.23:*:*:*:*:*:*:* Versions 5.0.23 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.25:*:*:*:*:*:*:* Versions 5.0.25 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.26:*:*:*:*:*:*:* Versions 5.0.26 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.28:*:*:*:*:*:*:* Versions 5.0.28 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.30:sp1:*:*:*:*:*:* Versions 5.0.30 sp1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.32:*:*:*:*:*:*:* Versions 5.0.32 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.34:*:*:*:*:*:*:* Versions 5.0.34 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.36:sp1:*:*:*:*:*:* Versions 5.0.36 sp1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.38:*:*:*:*:*:*:* Versions 5.0.38 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.40:*:*:*:*:*:*:* Versions 5.0.40 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.41:*:*:*:*:*:*:* Versions 5.0.41 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.42:*:*:*:*:*:*:* Versions 5.0.42 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.44:sp1:*:*:*:*:*:* Versions 5.0.44 sp1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.45:*:*:*:*:*:*:* Versions 5.0.45 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.46:*:*:*:*:*:*:* Versions 5.0.46 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.48:*:*:*:*:*:*:* Versions 5.0.48 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.50:*:*:*:*:*:*:* Versions 5.0.50 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.50:sp1:*:*:*:*:*:* Versions 5.0.50 sp1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.51:*:*:*:*:*:*:* Versions 5.0.51 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.52:*:*:*:*:*:*:* Versions 5.0.52 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.56:sp1:*:*:*:*:*:* Versions 5.0.56 sp1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.58:*:*:*:*:*:*:* Versions 5.0.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.60:sp1:*:*:*:*:*:* Versions 5.0.60 sp1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.62:*:*:*:*:*:*:* Versions 5.0.62 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.64:*:*:*:*:*:*:* Versions 5.0.64 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.0.66:sp1:*:*:*:*:*:* Versions 5.0.66 sp1 Vulnerable ·Oracle

Remediation

Red Hat 2 advisories

  • RHSA-2010:0110 Released 2010-02-16 · Red Hat rating Moderate
    mysql security update
    • Red Hat Enterprise Linux AS version 4 mysql-4.1.22-2.el4_8.3, mysql-4.1.22-2.el4_8.3.i386, mysql-4.1.22-2.el4_8.3.ia64 +13
    • Red Hat Enterprise Linux Desktop version 4 mysql-4.1.22-2.el4_8.3, mysql-4.1.22-2.el4_8.3.i386, mysql-bench-4.1.22-2.el4_8.3 +5
    • Red Hat Enterprise Linux ES version 4 mysql-4.1.22-2.el4_8.3, mysql-4.1.22-2.el4_8.3.i386, mysql-4.1.22-2.el4_8.3.ia64 +9
    • Red Hat Enterprise Linux WS version 4 mysql-4.1.22-2.el4_8.3, mysql-4.1.22-2.el4_8.3.i386, mysql-4.1.22-2.el4_8.3.ia64 +9
  • RHSA-2009:1067 Released 2009-05-26 · Red Hat rating Moderate
    Red Hat Application Stack v2.3 security and enhancement update
    • Red Hat Application Stack v2 for Enterprise Linux (v.5) httpd-2.2.11-2.el5s2, httpd-2.2.11-2.el5s2.i386, httpd-devel-2.2.11-2.el5s2 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AS version 4Fixed RHSA-2010:0110
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2010:0110
Red Hat Enterprise Linux ES version 4Fixed RHSA-2010:0110
Red Hat Enterprise Linux WS version 4Fixed RHSA-2010:0110

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-4098
  2. 2026-10-03 Alias added: GHSA-cwr2-c5mc-rxv6

References

Patch 1

Advisory 11

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences