Description

Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.

Remediation

References

CVE-2012-5627

Related Vulnerabilities

MongoDb Improper Input Validation Vulnerability (CVE-2021-20330)

XWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-35155)

WordPress Plugin WooCommerce Subscriptions Cross-Site Scripting (2.6.2)

PHP Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2011-0754)

PrestaShop Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2019-19594)

Severity

Medium

Classification

CVE-2012-5627 CWE-522

Tags

Missing Update Known Vulnerabilities