PT-2025-30639 · Oceanbase · Oceanbase

Published 2025-07-24 · Updated 2025-08-08 · CVE-2025-8107

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OceanBase (affected versions not specified)

Description A malicious user with specific privileges in OceanBase’s Oracle tenant mode can achieve privilege escalation to SYS-level access by executing carefully crafted commands. This issue only affects OceanBase tenants operating in Oracle mode; tenants in MySQL mode are not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Exposure of Resource to Wrong Sphere

Improper Privilege Management

Weakness Enumeration

CWE-668

CWE-269

Related Identifiers

CVE-2025-8107

Affected Products

Oceanbase

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-8107 · Security Note
• https://github.com/oceanbase/oceanbase/security · Note
• https://twitter.com/CVEnew/status/1948282164610470188 · Twitter Post
• https://twitter.com/marcin_brz81183/status/1948315124403478629 · Twitter Post
• https://twitter.com/jmdevlabs/status/1953966401745490254 · Twitter Post