CVE-2012-5615: mariadb
Vulnerability summary
CVE-2012-5615 is a medium (CVSS 5.0) vulnerability in mariadb. EPSS estimates a 14.78% chance of exploitation in the next 30 days, higher than 96.6% of scored vulnerabilities. 2 public exploits are recorded.
Weaponized exploit (exploit-database, 02-12-2012)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 12 · Related 5Timeline
- 03-12-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
14.78%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 14.78% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundMySQL - Remote User Enumeration
Maturity: weaponized
MySQL 5.1/5.5 (Windows) - 'MySQLJackpot' Remote Command Execution
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Ubuntu2 products
- mysql-5.5< 5.5.40-0ubuntu0.14.04.1
- mysql-5.6< 5.6.27-0ubuntu0.14.04.1
Mariadb1 product
- mariadbEOL5.1.66 | 5.2.13 | 5.3.11 | 5.5.28a
Oracle1 product
- mysqlEOL5.5.19
3 vendors · 4 products
References
14 links- mariadb.atlassian.net/browse/MDEV-3909X Refsource CONFIRM
Show all 14 references
- www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlX Refsource CONFIRM