Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2002-1374 — Authentication Bypass by Primary Weakness in Oracle Mysql

CWE-305 — Authentication Bypass by Primary WeaknessCWE-187 — Partial String Comparison7 documents6 sources
Severity
7.5HIGHNVD
EPSS
25.4%
top 3.78%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Oracle MysqlSymantec Veritas Netbackup Advanced ReporterSymantec Veritas Netbackup Global Data Manager
Timeline
PublishedDec 23
Latest updateApr 30

Description

The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶NVDoracle/mysql47 versions+46

Patches

Patch: www.linuxsecurity.com ↗Patch: www.securityfocus.com ↗Patch: www.linuxsecurity.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-rf99-cxf6-755h: The COM_CHANGE_USER command in MySQL 3↗2022-04-30
▶

💥Exploits & PoCs

1
Exploit-DB
MySQL 3.23.x/4.0.x - 'COM_CHANGE_USER' Password Length Account↗2002-12-16
▶

📋Vendor Advisories

1
Red Hat
security flaw↗2002-12-12
▶

📐Framework References

2
CWE
Authentication Bypass by Primary Weakness↗
▶
CWE
Partial String Comparison↗
▶

💬Community

1
Bugzilla
CVE-2002-1374 security flaw↗2018-08-16
▶