Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database cell, which might be accessed by this client when composing an HTML document. NOTE: as of 20081031, the issue has not been fixed in MySQL 5.0.67.
CVSS Details
- CVSS 3.1 Base Score: 6.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Mysql | — | Upgrade macOS to the latest version | Dec 16, 2011 | Oct 6, 2008 |
| Centos_linux | — | Upgrade mysqlUpgrade mysql-testUpgrade mysql-benchUpgrade mysql-develUpgrade mysql-server | Dec 1, 2016 | Oct 6, 2008 |
| Gentoo Linux | — | Upgrade dev-db/mysql. | Oct 30, 2017 | Oct 6, 2008 |
| Oracle_linux | — | Upgrade mysql-benchUpgrade mysqlUpgrade mysql-testUpgrade mysql-serverUpgrade mysql-devel | Oct 16, 2024 | Oct 6, 2008 |
| Suse | — | Upgrade mysql-sharedUpgrade mysql-develUpgrade libmysqlclient_r15Upgrade libmysqlclient-develUpgrade libmysqlclient_r15-64bitUpgrade mysql-testUpgrade mysql-shared-64bitUpgrade libmysqlclient15Upgrade mysql-debugUpgrade mysql-clientUpgrade mysql-shared-x86Upgrade libmysqlclient15-32bitUpgrade mysql-shared-32bitUpgrade mysql-benchUpgrade libmysqlclient15-64bitUpgrade libmysqlclient_r15-32bitUpgrade mysql-toolsUpgrade mysql-MaxUpgrade mysql | Feb 17, 2015 | Oct 6, 2008 |
| Ubuntu | — | Upgrade mysql-server-5.0Upgrade mysql-server-5.1 | Nov 8, 2024 | Oct 6, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub