CVE-2018-14669

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	ClickHouse	All versions prior to version 1.1.54390.

References

https://clickhouse.yandex/docs/en/security_changelog/Release Notes, Vendor Advisory
https://clickhouse.yandex/docs/en/security_changelog/Release Notes, Vendor Advisory

Timeline

Published: Aug 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-14677.5The IBM Storwize V7000 Unified management Web interface 1.6 exposes internal cluster details to unauthenticated users. IBM X-Force ID: 14039 CVE-2018-146709.8Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.CVE-2018-146719.8In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vu CVE-2018-146725.3In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messag CVE-2018-146787.8An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x8 CVE-2018-146796.5An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validi CVE-2018-14684.3IBM API Connect 5.0.8.1 and 5.0.8.2 could allow a user to get access to internal environment and sensitive API details to which they are not CVE-2018-146806.5An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.CVE-2018-146818.8An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a CVE-2018-146828.8An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompres CVE-2018-146836.1PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI.CVE-2018-146859.8The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a craf