VulnerabilityModified
CVE-2007-2691
MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables.
MEDIUM 4.9EPSS 2.85%
Does this matter?
Lower severity and a low EPSS score (2.85%). Track it; it rarely justifies an emergency change on its own.
Description
MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables.
- CVSS 2.0
- 4.9 MEDIUMAV:N/AC:M/Au:S/C:N/I:P/A:P
- EPSS
- 2.85% probability · 86th percentile
- CISA KEV
- Not listed
- Affected
- mysql/mysql · debian/debian linux · canonical/ubuntu linux
- Source
- cve@mitre.org
References
- http://bugs.mysql.com/bug.php?id=27515Vendor Advisory
- http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.htmlPatch, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlMailing List, Third Party Advisory
- http://lists.mysql.com/announce/470Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.htmlThird Party Advisory
- http://osvdb.org/34766Broken Link
- http://secunia.com/advisories/25301Third Party Advisory
- http://secunia.com/advisories/25946Third Party Advisory
- http://secunia.com/advisories/26073Third Party Advisory
- http://secunia.com/advisories/26430Third Party Advisory
- http://secunia.com/advisories/27155Third Party Advisory
- http://secunia.com/advisories/27823Third Party Advisory
- http://secunia.com/advisories/28838Third Party Advisory
- http://secunia.com/advisories/30351Third Party Advisory
- http://secunia.com/advisories/31226Third Party Advisory
- http://secunia.com/advisories/32222Third Party Advisory
- http://support.apple.com/kb/HT3216Third Party Advisory
- http://www.debian.org/security/2007/dsa-1413Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:139Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2007-0894.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0364.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0768.htmlThird Party Advisory
- http://www.securityfocus.com/archive/1/473874/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/24016Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/31681Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1018069Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2007/1804Third Party Advisory
- http://www.vupen.com/english/advisories/2008/2780Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34347Third Party Advisory, VDB Entry
- https://issues.rpath.com/browse/RPL-1536Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.