CVE-2025-8107

State: Published
Severity: 6.3 Medium
Published: Jul 24, 2025
Updated: Jul 31, 2025
Reserved: Jul 24, 2025

Description

In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executing carefully crafted commands.

This vulnerability only affects OceanBase tenants in Oracle mode. Tenants in MySQL mode are unaffected.

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	OB

Weaknesses

CWE-668 Exposure of Resource to Wrong Sphere
CWE-269 Improper Privilege Management

Affected Products

Product	Versions
OceanBase ServerOB	3.2.4.x to before 3.2.4.8Affected 4.2.1 x to before 4.2.1.10Affected 4.2.x to before 4.2.5Affected 4.3.3.x to before 4.3.3.2Affected 4.3.4Not affected

References

https://github.com/oceanbase/oceanbase/security

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.