Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2012-5627 — Insufficiently Protected Credentials in Mariadb

CWE-522 — Insufficiently Protected Credentials6 documents6 sources
Severity
4.0MEDIUMNVD
EPSS
3.9%
top 11.71%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
MariadbOracle Mysql
Timeline
PublishedOct 1
Latest updateMay 17

Description

Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 8.0 | Impact: 2.9

Affected Packages2 packages

▶NVDoracle/mysql5.5.0 — 5.5.29
▶NVDmariadb/mariadb5.2.0 — 5.2.14+3

Patches

Patch: security.gentoo.org ↗Patch: bugzilla.redhat.com ↗Patch: security.gentoo.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-46h7-m4g6-26pp: Oracle MySQL and MariaDB 5↗2022-05-17
▶
OSV
CVE-2012-5627: Oracle MySQL and MariaDB 5↗2013-10-01
▶

💥Exploits & PoCs

1
Exploit-DB
Oracle MySQL / MariaDB - Insecure Salt Generation Security Bypass↗2012-12-06
▶

📋Vendor Advisories

1
Red Hat
mysql: efficient password guessing attack using change_user()↗2012-12-03
▶

💬Community

1
Bugzilla
CVE-2012-5627 mysql: efficient password guessing attack using change_user()↗2012-12-05
▶