Is CVE-2009-4030 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 0%.

What products does CVE-2009-4030 affect?

Tracked products affected include MySQL. Check the version you run to see whether it is affected.

How do I fix CVE-2009-4030?

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

CVE-2009-4030

Q: What is CVE-2009-4030?

CVE-2009-4030 is a medium-severity software vulnerability (CWE-59) with a CVSS score of 4.4. MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames withou

MEDIUM severity · CVSS 4.4 · CWE-59

4.4CVSS MEDIUM

Summary

MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.

Impact & exploitability

Attack vectorLocal

Attack complexity—

Privileges required—

User interaction—

Confidentiality impact—

Integrity impact—

Availability impact—

Exploit probability (EPSS)0%

AV:L/AC:M/Au:N/C:P/I:P/A:P

Affected products we track (1)

MySQL

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

CVE-2009-4030

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information