CVE-2007-2692 Privilege escalation in n/a

Medium 6.0 Published 16 May 2007 Updated 7 Aug 2024

Authenticated users can escalate privileges by exploiting a flaw in MySQL's handling of stored routine security contexts.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2007-2692?

CVE-2007-2692 is a medium-severity vulnerability in Mysql Mysql, published on 16 May 2007. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.

Which versions are affected by CVE-2007-2692?

It affects 2 products.

Products include Mysql Mysql, Oracle Mysql.

How do I fix CVE-2007-2692?

Upgrade to a fixed version.

Is CVE-2007-2692 being exploited?

There is no known exploitation of CVE-2007-2692 in the wild and no public exploit code.

All Mysql Mysql vulnerabilities

Sources

Also known as GHSA-p759-pfvw-7vmx.