CVEvulnerability

CVE-2012-5627

4.0 MEDIUM Published 2013-10-01 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-10-01
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-522

Description

Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.

Affected configurations

• oracle mysql (>= 5.5.0 < 5.5.29) • mariadb mariadb (>= 5.2.0 < 5.2.14) • mariadb mariadb (>= 5.3.0 < 5.3.12) • mariadb mariadb (>= 5.5.0 < 5.5.29) • mariadb mariadb 10.0.0

Related

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References