Description
MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.
Remediation
References
Related Vulnerabilities
WordPress Plugin Slider Hero with Animation, Video Background Cross-Site Scripting (8.4.3)
Dot CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-3688)
WordPress Plugin Connections Business Directory Cross-Site Scripting (10.4.2)
WordPress Plugin ManageWP Worker Unspecified Vulnerability (4.1.7)