NVD

Id
54856  
Name
CVE-2007-2692  
Description
The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.  
Reject
 
CVSS Version
2  
CVSS Score
6  
Severity
Medium  
CVSS Base Score
6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2007-05-15  
Modified Date
2012-11-05  
Seq
2007-2692  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
278423 54856 CVE-2007-2692 http://bugs.mysql.com/bug.php?id=27337  View
278424 54856 CVE-2007-2692 http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html  View
278425 54856 CVE-2007-2692 [announce] 20070712 MySQL Community Server 5.0.45 has been released!  View
278426 54856 CVE-2007-2692 SUSE-SR:2008:003  View
278427 54856 CVE-2007-2692 oval:org.mitre.oval:def:9166  View
278428 54856 CVE-2007-2692 DSA-1413  View
278429 54856 CVE-2007-2692 MDVSA-2008:028  View
278430 54856 CVE-2007-2692 RHSA-2007:0894  View
278431 54856 CVE-2007-2692 RHSA-2008:0364  View
278432 54856 CVE-2007-2692 20070717 rPSA-2007-0143-1 mysql mysql-bench mysql-server  View
278433 54856 CVE-2007-2692 24011  View
278434 54856 CVE-2007-2692 1018070  View
278435 54856 CVE-2007-2692 USN-588-1  View
278436 54856 CVE-2007-2692 ADV-2007-1804  View
278437 54856 CVE-2007-2692 mysql-changedb-privilege-escalation(34348)  View
278438 54856 CVE-2007-2692 https://issues.rpath.com/browse/RPL-1536  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
51729 JVNDB-2007-000392 MySQL の mysql_change_db() 関数における権限昇格の脆弱性 MySQL には、mysql_change_db() 関数において SQL SECURITY INVOKER ストアドルーチンから戻る際に、THD::db_access の権限が切り替わらない問題が存在するため、権限昇格の脆弱性が存在します。 CVE-2007-2692 26047 CVE-2007-2692 54856 6 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000392.html 2007-05-15 2008-08-13 View