UpHeron
All vulnerabilities

Servers and applications

CVE-2008-4098

MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data…

Severity
Medium 4.6
Published
18 Sept 2008
Last changed
16 Jun 2026
Added to UpHeron
21 Oct 2026
Exploit chance
1.6% in the next 30 daysHigher than 76% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Link following (CWE-59)
Attack
Over the network · Only under certain conditions · Needs a login
Attacker can
Read some data · Change some data · Slow it down
CVSS vector
AV:N/AC:H/Au:S/C:P/I:P/A:P
Sources
NVD

Description

MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.

From NVD.

Affected software

SoftwareAffected versions
MySQLServers and applications · cpe:a:oracle:mysql
  • Version 5.0.66-sp1
  • Version 5.0.64
  • Version 5.0.62
  • Version 5.0.60-sp1
All 26 release lines
  • Version 5.0.23
  • Version 5.0.25
  • Version 5.0.26
  • Version 5.0.28
  • Version 5.0.30-sp1
  • Version 5.0.32
  • Version 5.0.34
  • Version 5.0.36-sp1
  • Version 5.0.38
  • Version 5.0.40
  • Version 5.0.41
  • Version 5.0.42
  • Version 5.0.44-sp1
  • Version 5.0.45
  • Version 5.0.46
  • Version 5.0.48
  • Version 5.0.50
  • Version 5.0.50-sp1
  • Version 5.0.51
  • Version 5.0.52
  • Version 5.0.56-sp1
  • Version 5.0.58
  • Version 5.0.60-sp1
  • Version 5.0.62
  • Version 5.0.64
  • Version 5.0.66-sp1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2008-4098
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2008-4098