CVE-2007-6303: MySQL

Low severity, CVSS 3.5. EPSS: 2.2% chance of exploitation in the next 30 days.

MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement.

Affected products

• MySQL MySQL: version 5.0.0 only; version 5.0.1 only; version 5.0.2 only; version 5.0.3 only; version 5.0.4 only; version 5.0.5 only; …
• Oracle MySQL: version 5.0.41 only; version 5.1.1 only; version 5.1.2 only; version 5.1.10 only; version 5.1.11 only; version 5.1.12 only; …

Published 2007-12-10. Last modified 2026-06-16.