CVE-2012-5627

2013-10-0117:55:00

CWE-522

[email protected]

web.nvd.nist.gov

698

cve-2012-5627

oracle

mysql

mariadb

remote authentication

brute force

password guessing

nvd

4.9 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

60.7%

JSON

Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.

CPENameOperatorVersion
oracle:mysqloracle mysqllt5.5.29
mariadb:mariadbmariadbeq10.0.0
mariadb:mariadbmariadblt5.2.14
mariadb:mariadbmariadblt5.3.12
mariadb:mariadbmariadblt5.5.29

CPE	Name	Operator	Version
oracle:mysql	oracle mysql	lt	5.5.29
mariadb:mariadb	mariadb	eq	10.0.0
mariadb:mariadb	mariadb	lt	5.2.14
mariadb:mariadb	mariadb	lt	5.3.12
mariadb:mariadb	mariadb	lt	5.5.29