CVE-2012-5627 describes a security bypass vulnerability in Oracle MySQL and MariaDB versions 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14. The flaw allows remote authenticated users to conduct brute-force password guessing attacks due to the salt not being modified during multiple executions of the change_user command within the same connection. With a CVSS score of 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N), this vulnerability has a network attack vector, low attack complexity, and could lead to partial confidentiality impact. While not actively exploited in the wild (KEV: No), an exploit is publicly available on ExploitDB (EDB-38109), though there is no evidence of active community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.5.0, < 5.5.29CPE matchmatch criteria | cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* | ||
>= 5.2.0, < 5.2.14CPE matchmatch criteria | cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* | ||
>= 5.3.0, < 5.3.12CPE matchmatch criteria | cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* | ||
>= 5.5.0, < 5.5.29CPE matchmatch criteria | cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* | ||
10.0.0CPE matchmatch criteria | cpe:2.3:a:mariadb:mariadb:10.0.0:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:S/C:P/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Oracle MySQL and MariaDB 5.5.x before 5.5.29 5.3.x before 5.3.12 and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.
Oct 2, 2013mysql: efficient password guessing attack using change_user()
Dec 3, 2012