Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2012-2122

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.

CVSS 5.1 · MediumBuzz score 24.41 public exploit repository references

Buzz score

Why this CVE is surfacing

Buzz score total 24.4

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 13.9 · diversity 6.5 · KEV 0.0 · OTX 0.0 · PoC 4.0
Mention score
13.9
3 evidence mentions in the snapshot
Diversity score
6.5
2 sources across 1 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
4.0
1 repos · best confidence 0.80
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
3 source links · newest first
  • Rapid7 Tool Checks for MySQL Auth Bypass VulnerabilitySecurityWeek

    New Tool Checks To See If MySQL Servers Are At Risk From The MySQL CVE-2012-2122 Vulnerability

    newswww.securityweek.comSep 20, 2012, 6:49 PM
  • MySQL Authentication Bypass Offers Lesson for DevelopersSecurityWeek

    Last month, a spotlight was put on a MySQL authentication bypass vulnerability that gave hackers a one out of 256 chance to gain access to the database regardless of whether or not they entered the wrong password. Versions of MariaDB were also affected by the bug, which Rapid7’s HD Moore at the time called “tragically comedic.” However, application firm Coverity said the situation also presents a learning opportunity for developers.

    newswww.securityweek.comJul 19, 2012, 9:18 PM
  • MySQL vulnerability allows attackers to bypass password verificationCSO Online

    Security researchers have released details about a vulnerability in the MySQL server that could allow potential attackers to access MySQL databases without inputting proper authentication credentials. The vulnerability is identified as CVE-2012-2122 and was addressed in MySQL 5.1.63 and 5.5.25 in May. However, many server administrators might not be aware of its impact, because the […]

    newswww.csoonline.comJun 11, 2012, 3:00 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

1 repository references · best confidence 0.80 · max 0 stars

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence