CVE-2007-5969

Severity: high (CVSS 7.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 14.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-12-10 · updated 2026-06-16
Weakness: CWE-264

Description

MySQL Community Server 5.0.x before 5.0.51, Enterprise Server 5.0.x before 5.0.52, Server 5.1.x before 5.1.23, and Server 6.0.x before 6.0.4, when a table relies on symlinks created through explicit DATA DIRECTORY and INDEX DIRECTORY options, allows remote authenticated users to overwrite system table information and gain privileges via a RENAME TABLE statement that changes the symlink to point to an existing file.

Affected products

Mysql Community Server: through 5.0.50; 5.0.41, 5.0.44, 5.0.45
Mysql Enterprise Server: 5.0.50
Mysql Server: 5.1.22, 6.0, 6.0.1, 6.0.2, 6.0.3

References

http://bugs.mysql.com/32111
http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html
http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-51.html
http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-52.html
http://forums.mysql.com/read.php?3%2C186931%2C186931
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
http://lists.mysql.com/announce/495
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
http://secunia.com/advisories/27981
http://secunia.com/advisories/28025
http://secunia.com/advisories/28040
http://secunia.com/advisories/28063

Get alerted when CVE-2007-5969 or the next vulnerability affects your stack