$ cve CVE-2012-2122 JSON

CVE-2012-2122 EXPLOIT

5.1

MEDIUM · CVSS 2.0 · EPSS 96.5% (pctl 100)

Patch early

A public exploit exists.

Description

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.

Scoring

CVSS	5.1 (MEDIUM, v2.0)
Vector	AV:N/AC:H/Au:N/C:P/I:P/A:P
EPSS	96.5% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-287
On CISA KEV	no
Public exploit	yes
Published	2012-06-26
Last modified	2026-06-16

Affected (2)

Vendor	Product
mariadb	mariadb
oracle	mysql

Public exploits

Source	Title	Date
exploit-db	MySQL - Authentication Bypass	2012-06-12

References

→ the Explorer · watch your stack · NVD