CVE-2007-2692

Description

The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.

6.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 0.58%

Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory debian.org Vendor Advisory ubuntu.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
http://secunia.com/advisories/27823	third party advisory
http://secunia.com/advisories/29443	third party advisory
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html
http://www.redhat.com/support/errata/RHSA-2007-0894.html	vendor advisory
http://secunia.com/advisories/26073	third party advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:028	vendor advisory
http://lists.mysql.com/announce/470	mailing list
http://www.vupen.com/english/advisories/2007/1804	vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9166	vdb entry signature
http://www.securityfocus.com/archive/1/473874/100/0/threaded	mailing list
http://www.securitytracker.com/id?1018070	vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/34348	vdb entry
http://secunia.com/advisories/25301	third party advisory vendor advisory
http://www.debian.org/security/2007/dsa-1413	vendor advisory
https://issues.rpath.com/browse/RPL-1536
http://secunia.com/advisories/28637	third party advisory
http://secunia.com/advisories/30351	third party advisory
http://bugs.mysql.com/bug.php?id=27337
http://secunia.com/advisories/26430	third party advisory
http://secunia.com/advisories/28838	third party advisory
http://www.ubuntu.com/usn/usn-588-1	vendor advisory
http://osvdb.org/34765	vdb entry
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html	vendor advisory
http://www.redhat.com/support/errata/RHSA-2008-0364.html	vendor advisory
http://www.securityfocus.com/bid/24011	vdb entry

Frequently Asked Questions

What is the severity of CVE-2007-2692?: CVE-2007-2692 has been scored as a medium severity vulnerability.
How to fix CVE-2007-2692?: To fix CVE-2007-2692, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2007-2692 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2007-2692 is being actively exploited. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.