« Volver al listado

CVE-2007-6303

Estado: ModificadaBaja (3.5)—

MySQL versiones 5.0.x anteriores a 5.0.51a, versiones 5.1.x anteriores a 5.1.23 y versiones 6.0.x anteriores a 6.0.4, no actualizan el valor DEFINER de una vista cuando se modifica la vista, lo que permite a usuarios remotos autenticados alcanzar privilegios por medio de una secuencia de sentencias, incluyendo una sentencia CREATE SQL SECURITY DEFINER VIEW y una sentencia ALTER VIEW.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Mysql — MysqlOracle — Mysql

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-6303",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-12-10T21:46:00.000",
  "references": [
    {
      "url": "http://bugs.mysql.com/bug.php?id=29908",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-52.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://dev.mysql.com/doc/refman/6.0/en/news-6-0-4.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.mysql.com/announce/502",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/28025",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/28063",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/28739",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/28838",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/29443",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/29706",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200804-04.xml",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1019085",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0040",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:017",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2007-1157.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/487606/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/26832",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-588-1",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/4198",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38989",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://issues.rpath.com/browse/RPL-2187",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00467.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00475.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://bugs.mysql.com/bug.php?id=29908",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-52.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://dev.mysql.com/doc/refman/6.0/en/news-6-0-4.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.mysql.com/announce/502",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28025",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28063",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28739",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28838",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/29443",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/29706",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200804-04.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1019085",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0040",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:017",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2007-1157.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/487606/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/26832",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-588-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/4198",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38989",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://issues.rpath.com/browse/RPL-2187",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00467.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00475.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement."
    },
    {
      "lang": "es",
      "value": "MySQL versiones 5.0.x anteriores a 5.0.51a, versiones 5.1.x anteriores a 5.1.23 y versiones 6.0.x anteriores a 6.0.4, no actualizan el valor DEFINER de una vista cuando se modifica la vista, lo que permite a usuarios remotos autenticados alcanzar privilegios por medio de una secuencia de sentencias, incluyendo una sentencia CREATE SQL SECURITY DEFINER VIEW y una sentencia ALTER VIEW."
    }
  ],
  "lastModified": "2026-06-16T22:47:47.247",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC198CDB-CAC0-41DD-9FCD-42536E7FE11A"
            },
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B77A2761-2B44-4061-9C29-A54F90A1AD83"
            },
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B3AD851-056F-4E57-B85B-4AC5A5A20C0C"
            },
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD24EA8C-4FCA-4F40-B2EA-7DFA49432483"
            },
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "754B78F2-A03C-40BE-812B-F5E57B93D20B"
            },
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "575039BD-A8B6-4459-B5F0-F220A94650EA"
            },
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.5.0.21:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDA03768-74D2-4C5D-ABCF-8A91F9E6C273"
            },
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "542B23CB-7535-4EF7-B926-466A5161A0D4"
            },
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45E686C3-4100-465C-9F45-068580B496E5"
            },
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E9F09D8-6FAE-4A5B-AE04-248CD52C5FF4"
            },
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB618DB2-6B00-4E99-8232-937D2C51986B"
            },
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "665E063D-355D-4A5A-A05F-36BF582DE36F"
            },
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.22.1.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "214E3CF9-6362-4F5A-91B7-5E69564F7144"
            },
            {
              "criteria": "cpe:2.3:a:mysql:mysql:5.0.24:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4C6CD84-EA5D-451F-AFC3-5F7094F0017D"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:5.0.41:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4413BB52-6FBD-4C12-8864-ADDC65E45B25"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:5.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73F49A1D-BCA3-4772-8AB3-621CCC997B3A"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:5.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F719DD8E-8379-43C3-97F9-DE350E457F7F"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:5.1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6341F695-6034-4CC1-9485-ACD3A0E1A079"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:5.1.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1DF5F19-ECD9-457F-89C6-6F0271CF4766"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:5.1.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "446DB5E9-EF4C-4A53-911E-91A802AECA5D"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:5.1.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5829BE6A-BC58-482B-9DA1-04FDD413A7A9"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:5.1.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C85D20DF-702B-4F0B-922D-782474A4B663"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:5.1.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73A09785-3CA4-4797-A836-A958DCDC322F"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:5.1.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4DE3D79-0966-4E14-9288-7C269A2CEEC3"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:5.1.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "564F6A24-BEB3-4420-A633-8AD54C292436"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:6.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F48E7355-2D9A-454D-AE66-B0AE015E31A6"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:6.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E51BF67A-BAEC-48F8-9290-67C6C5B8442E"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:6.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F5C6A2F-DEAE-470D-8888-0E9076CCA0B6"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql:6.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C09231E-8759-4DFB-AA8D-17A1C6D43AC1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "This issue did not affect the mysql packages as shipped in Red Hat Enterprise Linux 2.1, 3, 4, or 5.\n\nThis issue affected the mysql packages as shipped in Red Hat Application Stack v1 and v2 and was addressed by RHSA-2007:1157:\nhttp://rhn.redhat.com/errata/RHSA-2007-1157.html",
      "lastModified": "2008-01-09T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}