CVE-2012-5627: mariadb Insufficiently Protected Credentials
Vulnerability summary
CVE-2012-5627 is a medium (CVSS 4.0) Insufficiently Protected Credentials vulnerability in mariadb. EPSS estimates a 11.41% chance of exploitation in the next 30 days, higher than 96% of scored vulnerabilities. 3 public exploits are recorded.
Weaponized exploit (exploit-database, 06-12-2012)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 01-10-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
11.41%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 11.41% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Oracle MySQL / MariaDB - Insecure Salt Generation Security Bypass
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, authentication (CVSS vector). Other conditions: not stated in public data.
Mariadb1 product
- mariadbEOL≥ 5.2.0, < 5.2.14 | ≥ 5.3.0, < 5.3.12 | ≥ 5.5.0, < 5.5.29 | 10.0.0
Oracle1 product
- mysql≥ 5.5.0, < 5.5.29
Ubuntu1 product
- mysql-5.5All versions (No fix recorded)
3 vendors · 3 products
References
11 links- seclists.org/fulldisclosure/2012/Dec/58Mailing ListX Refsource FULLDISCExploitThird Party AdvisoryREPORT
- www.mandriva.com/security/advisories?name=MDVSA-2013:102Vendor AdvisoryX Refsource MANDRIVABroken Link
- security.gentoo.org/glsa/glsa-201308-06.xmlVendor AdvisoryX Refsource GENTOOPatchThird Party AdvisoryVDB Entry
