Auth bypass in Mariadb
CVE-2012-2122
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with c…
Vulnerability class: Broken Authentication
EPSS: 0.941 (99.9th percentile) — read the EPSS interpretation.
Affected products
- Mariadb — versions 5.1.41, 5.1.42, 5.1.44
- Oracle Mysql — versions 5.1.51, 5.1.52, 5.1.53
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (Exploit, x_refsource_MISC)
- 53911 (Exploit, vdb-entry, x_refsource_BID)
- 19092 (exploit, x_refsource_EXPLOIT-DB)
- 53372 (x_refsource_SECUNIA, third-party-advisory)
- GLSA-201308-06 (vendor-advisory, x_refsource_GENTOO)
- SUSE-SU-2012:0984 (vendor-advisory, x_refsource_SUSE)
- secalert@redhat.com (Exploit, x_refsource_MISC)
- 1027143 (vdb-entry, x_refsource_SECTRACK)
- 49417 (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- [oss-security] 20120609 Security vulnerability in MySQL/MariaDB sql/password.c (mailing-list, x_refsource_MLIST, Patch)
Frequently asked questions
- What is CVE-2012-2122?
- CVE-2012-2122 is a vulnerability in Mariadb, classified under Improper Authentication. Published 2012-06-26.
- Is CVE-2012-2122 known to be exploited?
- 47 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.