PT-2025-30639 · Oceanbase · Oceanbase

Publicado 2025-07-24 · Atualizado 2025-08-08 · CVE-2025-8107

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OceanBase (affected versions not specified)

Description A malicious user with specific privileges in OceanBase’s Oracle tenant mode can achieve privilege escalation to SYS-level access by executing carefully crafted commands. This issue only affects OceanBase tenants operating in Oracle mode; tenants in MySQL mode are not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Exposure of Resource to Wrong Sphere

Improper Privilege Management

Enumeração de Fraquezas

CWE-668

CWE-269

Identificadores relacionados

CVE-2025-8107

Produtos afetados

Oceanbase

Referências · 5

• https://github.com/oceanbase/oceanbase/security · Nota
• https://twitter.com/CVEnew/status/1948282164610470188 · Publicação no Twitter
• https://twitter.com/marcin_brz81183/status/1948315124403478629 · Publicação no Twitter
• https://twitter.com/jmdevlabs/status/1953966401745490254 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-8107 · Nota de Segurança