CVE-2007-6303

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-12-10 · updated 2026-06-16

Description

MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement.

Affected products

Mysql: 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5 (+8)
MySQL Server: 5.0.41, 5.1.1, 5.1.2, 5.1.10, 5.1.11, 5.1.12 (+9)

References

http://bugs.mysql.com/bug.php?id=29908
http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-52.html
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html
http://dev.mysql.com/doc/refman/6.0/en/news-6-0-4.html
http://lists.mysql.com/announce/502
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
http://secunia.com/advisories/28025
http://secunia.com/advisories/28063
http://secunia.com/advisories/28739
http://secunia.com/advisories/28838
http://secunia.com/advisories/29443
http://secunia.com/advisories/29706

Get alerted when CVE-2007-6303 or the next vulnerability affects your stack