{"id":"CVE-2012-2122","url":"https://www.cyber-defence.io/tools/cve/CVE-2012-2122","generatedAt":"2026-11-05T08:12:35.029Z","title":"sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain…","description":"sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.","published":"2012-06-26T18:55:05.000Z","lastModified":"2026-06-16T23:41:02.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"2.0","score":5.1,"severity":"MEDIUM","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P"},"cwe":["CWE-287"],"affected":["oracle/mysql","mariadb/mariadb"],"epss":{"score":0.96619,"percentile":0.99883,"date":"2026-11-04","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2012-06-12","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":19092,"kind":"exploit","title":"MySQL - Authentication Bypass","url":"https://www.exploit-db.com/exploits/19092","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/19092.py","file":"exploits/multiple/remote/19092.py","published":"2012-06-12","added":"2012-06-12","updated":"2016-12-05","author":"David Kennedy (ReL1K)","type":"remote","platform":"multiple","port":null,"verified":true,"codes":["OSVDB-82804","CVE-2012-2122"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 96.6%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://bugs.mysql.com/bug.php?id=64884","tags":["Exploit"],"source":"secalert@redhat.com"},{"url":"http://kb.askmonty.org/en/mariadb-5162-release-notes/","source":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html","source":"secalert@redhat.com"},{"url":"http://seclists.org/oss-sec/2012/q2/493","tags":["Patch"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/49417","tags":["Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/53372","source":"secalert@redhat.com"},{"url":"http://security.gentoo.org/glsa/glsa-201308-06.xml","source":"secalert@redhat.com"},{"url":"http://securitytracker.com/id?1027143","source":"secalert@redhat.com"},{"url":"http://www.exploit-db.com/exploits/19092","source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/53911","tags":["Exploit"],"source":"secalert@redhat.com"},{"url":"https://community.rapid7.com/community/metasploit/blog/2012/06/11/cve-2012-2122-a-tragically-comedic-security-flaw-in-mysql","tags":["Exploit"],"source":"secalert@redhat.com"},{"url":"http://bugs.mysql.com/bug.php?id=64884","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://kb.askmonty.org/en/mariadb-5162-release-notes/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/oss-sec/2012/q2/493","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/49417","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/53372","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://security.gentoo.org/glsa/glsa-201308-06.xml","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1027143","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.exploit-db.com/exploits/19092","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/53911","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://community.rapid7.com/community/metasploit/blog/2012/06/11/cve-2012-2122-a-tragically-comedic-security-flaw-in-mysql","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-2122","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}