CVE-2002-1374 : The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, a

The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.

Published 2002-12-23 05:00:00

Updated 2019-10-07 16:41:45

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2002-1374

Oracle » Mysql » Version: 3.22.27
cpe:2.3:a:oracle:mysql:3.22.27:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.22.29
cpe:2.3:a:oracle:mysql:3.22.29:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.8
cpe:2.3:a:oracle:mysql:3.23.8:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.22.30
cpe:2.3:a:oracle:mysql:3.22.30:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.10
cpe:2.3:a:oracle:mysql:3.23.10:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.9
cpe:2.3:a:oracle:mysql:3.23.9:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.22.26
cpe:2.3:a:oracle:mysql:3.22.26:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 4.0.1
cpe:2.3:a:oracle:mysql:4.0.1:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.49
cpe:2.3:a:oracle:mysql:3.23.49:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 4.0.0
cpe:2.3:a:oracle:mysql:4.0.0:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.26
cpe:2.3:a:oracle:mysql:3.23.26:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.27
cpe:2.3:a:oracle:mysql:3.23.27:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.28
cpe:2.3:a:oracle:mysql:3.23.28:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.37
cpe:2.3:a:oracle:mysql:3.23.37:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.38
cpe:2.3:a:oracle:mysql:3.23.38:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.44
cpe:2.3:a:oracle:mysql:3.23.44:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.45
cpe:2.3:a:oracle:mysql:3.23.45:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.52
cpe:2.3:a:oracle:mysql:3.23.52:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.53
cpe:2.3:a:oracle:mysql:3.23.53:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 4.0.3
cpe:2.3:a:oracle:mysql:4.0.3:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 4.0.5a
cpe:2.3:a:oracle:mysql:4.0.5a:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.22.32
cpe:2.3:a:oracle:mysql:3.22.32:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.29
cpe:2.3:a:oracle:mysql:3.23.29:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.3
cpe:2.3:a:oracle:mysql:3.23.3:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.39
cpe:2.3:a:oracle:mysql:3.23.39:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.4
cpe:2.3:a:oracle:mysql:3.23.4:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.46
cpe:2.3:a:oracle:mysql:3.23.46:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.47
cpe:2.3:a:oracle:mysql:3.23.47:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.53a
cpe:2.3:a:oracle:mysql:3.23.53a:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.2
cpe:2.3:a:oracle:mysql:3.23.2:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.23
cpe:2.3:a:oracle:mysql:3.23.23:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.30
cpe:2.3:a:oracle:mysql:3.23.30:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.31
cpe:2.3:a:oracle:mysql:3.23.31:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.40
cpe:2.3:a:oracle:mysql:3.23.40:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.41
cpe:2.3:a:oracle:mysql:3.23.41:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.48
cpe:2.3:a:oracle:mysql:3.23.48:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.22.28
cpe:2.3:a:oracle:mysql:3.22.28:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.24
cpe:2.3:a:oracle:mysql:3.23.24:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.25
cpe:2.3:a:oracle:mysql:3.23.25:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.34
cpe:2.3:a:oracle:mysql:3.23.34:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.36
cpe:2.3:a:oracle:mysql:3.23.36:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.42
cpe:2.3:a:oracle:mysql:3.23.42:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.43
cpe:2.3:a:oracle:mysql:3.23.43:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.5
cpe:2.3:a:oracle:mysql:3.23.5:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.50
cpe:2.3:a:oracle:mysql:3.23.50:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 3.23.51
cpe:2.3:a:oracle:mysql:3.23.51:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql » Version: 4.0.2
cpe:2.3:a:oracle:mysql:4.0.2:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Advanced Reporter » Version: 3.4
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:3.4:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Advanced Reporter » Version: 4.5
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Advanced Reporter » Version: 4.5 Fp1
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp1:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Advanced Reporter » Version: 4.5 Fp2
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp2:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Advanced Reporter » Version: 4.5 Fp3
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_fp3:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Advanced Reporter » Version: 4.5 Mp1
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp1:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Advanced Reporter » Version: 4.5 Mp2
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp2:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Advanced Reporter » Version: 4.5 Mp3
cpe:2.3:a:symantec_veritas:netbackup_advanced_reporter:4.5_mp3:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Global Data Manager » Version: 4.5
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Global Data Manager » Version: 4.5 Fp1
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp1:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Global Data Manager » Version: 4.5 Fp2
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp2:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Global Data Manager » Version: 4.5 Fp3
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_fp3:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Global Data Manager » Version: 4.5 Mp1
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp1:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Global Data Manager » Version: 4.5 Mp2
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp2:*:*:*:*:*:*:*
Matching versions
Symantec Veritas » Netbackup Global Data Manager » Version: 4.5 Mp3
cpe:2.3:a:symantec_veritas:netbackup_global_data_manager:4.5_mp3:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2002-1374

EPSS FAQ

1.36%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 86 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2002-1374

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

References for CVE-2002-1374

Jump to

Vulnerability Details : CVE-2002-1374

Products affected by CVE-2002-1374

Exploit prediction scoring system (EPSS) score for CVE-2002-1374

CVSS scores for CVE-2002-1374

References for CVE-2002-1374