PT-2006-1440 · Oracle · Mysql Server

Published

2006-01-22

·

Updated

2024-08-07

·

CVE-2006-0369

CVSS v2.0

2.1

Low

VectorAV:L/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions MySQL version 5.0.18
Description The issue allows local users with access to a VIEW to obtain sensitive information via the "SELECT * FROM information schema.views;" query, which returns the query that created the VIEW. It is noted that the availability of the schema is sometimes a normal and desired aspect of database access, and this issue has been disputed by third parties.
Recommendations For MySQL version 5.0.18, consider restricting access to the information schema.views to minimize the risk of sensitive information disclosure. As a temporary workaround, limit the use of the "SELECT * FROM information schema.views;" query to only those users who require it for legitimate database access purposes.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2006-0369

Affected Products

Mysql Server