CVE-2012-5627

Exploit

EPSS 4.13%
Published 01.10.2013 17:55:03
Last modified 11.04.2025 00:51:21
Source secalert@redhat.com
Teams watchlist Login
Open Login

Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.

Affected products Warnungen 0 Metrics 2 CWE 1 References 11

Data is provided by the National Vulnerability Database (NVD)

Oracle ≫ Mysql Version >= 5.5.0 < 5.5.29

Mariadb ≫ Mariadb Version >= 5.2.0 < 5.2.14

Mariadb ≫ Mariadb Version >= 5.3.0 < 5.3.12

Mariadb ≫ Mariadb Version >= 5.5.0 < 5.5.29

Mariadb ≫ Mariadb Version10.0.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	4.13%	0.882

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

http://secunia.com/advisories/53372

Not Applicable

http://security.gentoo.org/glsa/glsa-201308-06.xml

Patch

Third Party Advisory

VDB Entry

http://www.mandriva.com/security/advisories?name=MDVSA-2013:102

Broken Link

http://seclists.org/fulldisclosure/2012/Dec/58

Third Party Advisory

Exploit

Mailing List