Description

The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.

Remediation

References

CVE-2007-2692

Related Vulnerabilities

Oracle JRE CVE-2012-3216 Vulnerability (CVE-2012-3216)

WordPress Plugin Content Aware Sidebars-Unlimited Widget Areas Security Bypass (3.8)

WordPress Plugin Product Lister for Walmart Remote Code Execution (1.0.1)

EspoCRM Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2022-38843)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7936)

Severity

Medium

Classification

CVE-2007-2692

Tags

Missing Update Known Vulnerabilities