NetSight
IP …
low3.5

CVE-2007-6303

MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remo…

Impact

MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement.

Affected products

VendorProductAffected versions
MysqlMysql
Versions 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5
OracleMysql
Versions 5.0.41, 5.1.1, 5.1.2, 5.1.10, 5.1.11, 5.1.12

References