Information disclosure in Mariadb

CVE-2012-5615

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.

Vulnerability class: Information Disclosure

EPSS: 0.148 (96.3th percentile) — read the EPSS interpretation.

Affected products

  • Mariadb — versions 5.1.66, 5.2.13, 5.3.11
  • Oracle Mysql — versions 5.5.19
  • N/a — versions n/a

Weakness classification (CWE)

References