Vulnerability Details : CVE-2007-6303
MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement.
Exploit prediction scoring system (EPSS) score for CVE-2007-6303
Probability of exploitation activity in the next 30 days: 0.23%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 60 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2007-6303
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
6.8
|
2.9
|
[email protected] |
Vendor statements for CVE-2007-6303
-
Red Hat 2008-01-09This issue did not affect the mysql packages as shipped in Red Hat Enterprise Linux 2.1, 3, 4, or 5. This issue affected the mysql packages as shipped in Red Hat Application Stack v1 and v2 and was addressed by RHSA-2007:1157: http://rhn.redhat.com/errata/RHSA-2007-1157.html
- http://www.securityfocus.com/archive/1/487606/100/0/threaded
- https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00467.html
- http://www.securityfocus.com/bid/26832
- http://lists.mysql.com/announce/502
-
http://bugs.mysql.com/bug.php?id=29908
Exploit
- http://securitytracker.com/id?1019085
- http://security.gentoo.org/glsa/glsa-200804-04.xml
- http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-52.html
-
http://www.redhat.com/support/errata/RHSA-2007-1157.html
Vendor Advisory
-
http://www.vupen.com/english/advisories/2007/4198
Vendor Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:017
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0040
- http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/38989
- http://www.ubuntu.com/usn/usn-588-1
- http://dev.mysql.com/doc/refman/6.0/en/news-6-0-4.html
- https://issues.rpath.com/browse/RPL-2187
- http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html
- https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00475.html
- cpe:2.3:a:oracle:mysql:5.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.0.41:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.15:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.16:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.12:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.17:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.13:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:5.1.14:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:6.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:6.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:6.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.20:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.5.0.21:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.22.1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mysql:mysql:5.0.24:*:*:*:*:*:*:*