CVE-2012-5627

Exploit

EPSS 4.13%
Veröffentlicht 01.10.2013 17:55:03
Zuletzt bearbeitet 11.04.2025 00:51:21
Quelle secalert@redhat.com
Teams Watchlist Login
Unerledigt Login

Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 11

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Oracle ≫ Mysql Version >= 5.5.0 < 5.5.29

Mariadb ≫ Mariadb Version >= 5.2.0 < 5.2.14

Mariadb ≫ Mariadb Version >= 5.3.0 < 5.3.12

Mariadb ≫ Mariadb Version >= 5.5.0 < 5.5.29

Mariadb ≫ Mariadb Version10.0.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	4.13%	0.882

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

http://secunia.com/advisories/53372

Not Applicable

http://security.gentoo.org/glsa/glsa-201308-06.xml

Patch

Third Party Advisory

VDB Entry

http://www.mandriva.com/security/advisories?name=MDVSA-2013:102

Broken Link

http://seclists.org/fulldisclosure/2012/Dec/58

Third Party Advisory

Exploit

Mailing List