Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2015-3152

21
FAUCET Score

CVE-2015-3152, dubbed the "BACKRONYM" attack, affects Oracle MySQL (before 5.7.3), Oracle MySQL Connector/C (before 6.1.3), and MariaDB (before 5.5.44). The vulnerability stems from the --ssl option being interpreted as optional, enabling man-in-the-middle attackers to spoof servers through a cleartext-downgrade attack. This medium-severity flaw (CVSS 5.9) has a high impact on integrity, requiring high attack complexity, but no user interaction. While not listed in KEV or having public exploit code, it garnered significant community discussion and media coverage at the time of its discovery.

Impacted Technologies

VendorProductVersion(s)CPE
<= 5.7.2CPE matchmatch criteria
cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
<= 6.1.2CPE matchmatch criteria
cpe:2.3:a:oracle:mysql_connector\/c:*:*:*:*:*:*:*:*
>= 5.5.0, < 5.5.44CPE matchmatch criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
>= 10.0.0, < 10.0.20CPE matchmatch criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
21CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.9MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
2.2
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
7.08%
Probability of exploitation in next 30 days
EPSS Percentile
93.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0708 is in the 93rd percentile among its peer group of 19,958 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (18)

github_advisorypatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: mariadb-1:5.5.44-1.ael7b_1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-mariadb100-mariadb-1:10.0.20-1.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: mariadb55-mariadb-0:5.5.44-1.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUSFixed in: rh-mariadb100-mariadb-1:10.0.20-1.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUSFixed in: mariadb55-mariadb-0:5.5.44-1.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: rh-mariadb100-mariadb-1:10.0.20-1.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: mariadb55-mariadb-0:5.5.44-1.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-mariadb100-mariadb-1:10.0.20-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: mariadb55-mariadb-0:5.5.44-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUSFixed in: rh-mariadb100-mariadb-1:10.0.20-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUSFixed in: mariadb55-mariadb-0:5.5.44-1.el7
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: mysql55-mysql
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: mysql
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)Fixed in: mariadb-galera
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux OpenStack Platform 6 (Juno)Fixed in: mariadb-galera
redhatend of lifevia redhat_api
Product: Red Hat Software CollectionsFixed in: mysql55-mysql
redhatend of lifevia redhat_api
Product: Red Hat Software CollectionsFixed in: rh-mysql56-mysql

Vendor Advisories (1)

redhatCVE-2015-3152Moderate

mysql: use of SSL/TLS can not be enforced in mysql client library (oCERT-2015-003, BACKRONYM)

Apr 29, 2015

References

lists.fedoraproject.org / pipermail/package-announce/2015-July/161436.html
Mailing ListThird Party Advisory
lists.fedoraproject.org / pipermail/package-announce/2015-July/161625.html
Mailing ListThird Party Advisory
mysqlblog.fivefarmers.com / 2014/04/02/redefining-ssl-option
ExploitThird Party Advisory
mysqlblog.fivefarmers.com / 2015/04/29/ssltls-in-5-6-and-5-5-ocert-advisory
Third Party Advisory
packetstormsecurity.com / files/131688/MySQL-SSL-TLS-Downgrade.html
Third Party AdvisoryVDB Entry
rhn.redhat.com / errata/RHSA-2015-1646.html
Third Party Advisory
rhn.redhat.com / errata/RHSA-2015-1647.html
Third Party Advisory
rhn.redhat.com / errata/RHSA-2015-1665.html
Third Party Advisory
access.redhat.com / security/cve/cve-2015-3152
Third Party Advisory
github.com / mysql/mysql-server/commit/3bd5589e1a5a93f9c224badf983cd65c45215390
PatchThird Party Advisory
jira.mariadb.org / browse/MDEV-7937
Issue TrackingVendor Advisory
duosecurity.com / blog/backronym-mysql-vulnerability
Third Party Advisory
debian.org / security/2015/dsa-3311
Third Party Advisory
ocert.org / advisories/ocert-2015-003.html
Vendor Advisory
securityfocus.com / archive/1/535397/100/1100/threaded
Third Party AdvisoryVDB Entry
securityfocus.com / bid/74398
Third Party AdvisoryVDB Entry
securitytracker.com / id/1032216
Third Party AdvisoryVDB Entry