CVE-2002-1374: Oracle MySQL

High severity, CVSS 7.5. EPSS: 20.5% chance of exploitation in the next 30 days.

The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.

Affected products

• Oracle MySQL: version 3.22.26 only; version 3.22.27 only; version 3.22.28 only; version 3.22.29 only; version 3.22.30 only; version 3.22.32 only; …
• Symantec Veritas Netbackup Advanced Reporter: version 3.4 only; version 4.5 only; version 4.5_fp1 only; version 4.5_fp2 only; version 4.5_fp3 only; version 4.5_mp1 only; …
• Symantec Veritas Netbackup Global Data Manager: version 4.5 only; version 4.5_fp1 only; version 4.5_fp2 only; version 4.5_fp3 only; version 4.5_mp1 only; version 4.5_mp2 only; …

Published 2002-12-23. Last modified 2026-06-16.