Every CVE Search/ Get API key

CVE-2012-2122

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6,...

5.1 MediumPublic exploit

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.

Exploit likelihood

96.6%Up 5.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.1

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.

Record
CVE-2012-2122
CVSS 2.0
5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.

Record
CVE-2012-2122
Updated
2026-11-02
EUVDEUVD-2012-2124 No score

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.

Record
EUVD-2012-2124
Updated
2026-11-03
GitHub AdvisoriesGHSA-4qx9-mwf7-7cx8 No score

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6,...

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.

Record
GHSA-4qx9-mwf7-7cx8
Weakness
CWE-287
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mysql-5.1
Debian:6.0
From an advisory covering 10 CVEs
 before 5.1.63-0+squeeze1, plus listed versions
5.1.49-35.1.50-15.1.51-15.1.53-15.1.54-1
Show 16 moreShow less
5.1.54-25.1.55-15.1.56-15.1.57-15.1.57-1.15.1.57-1.25.1.57-1.35.1.57-25.1.57-35.1.57-3.15.1.58-15.1.61-0+squeeze15.1.61-25.1.61-35.1.62-15.1.62-1+m68k
5.1.63-0+squeeze1
mysql
Red Hat:enterprise_linux:6::client
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-libs
Red Hat:enterprise_linux:6::client
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-server
Red Hat:enterprise_linux:6::client
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-bench
Red Hat:enterprise_linux:6::client
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-embedded
Red Hat:enterprise_linux:6::client
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-embedded-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-test
Red Hat:enterprise_linux:6::client
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
Show 27 moreShow less
Affected packages
PackageAffectedFixed
mysql
Red Hat:enterprise_linux:6::computenode
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-libs
Red Hat:enterprise_linux:6::computenode
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-bench
Red Hat:enterprise_linux:6::computenode
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-embedded
Red Hat:enterprise_linux:6::computenode
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-embedded-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-server
Red Hat:enterprise_linux:6::computenode
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-test
Red Hat:enterprise_linux:6::computenode
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql
Red Hat:enterprise_linux:6::server
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-bench
Red Hat:enterprise_linux:6::server
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-libs
Red Hat:enterprise_linux:6::server
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-server
Red Hat:enterprise_linux:6::server
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-test
Red Hat:enterprise_linux:6::server
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-embedded
Red Hat:enterprise_linux:6::server
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-embedded-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql
Red Hat:enterprise_linux:6::workstation
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-bench
Red Hat:enterprise_linux:6::workstation
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-libs
Red Hat:enterprise_linux:6::workstation
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-server
Red Hat:enterprise_linux:6::workstation
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-test
Red Hat:enterprise_linux:6::workstation
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-embedded
Red Hat:enterprise_linux:6::workstation
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3
mysql-embedded-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 18 CVEs
 before 0:5.1.66-1.el6_3
0:5.1.66-1.el6_3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBMySQL - Authentication Bypass2012-06-12
PoC in GitHubAvinza/CVE-2012-2122-scanner2013-05-09
PoC in GitHubcyberharsh/Oracle-mysql-CVE-2012-21222020-06-24
PoC in GitHubzhangkaibin0921/CVE-2012-21222023-12-01
PoC in GitHubnetw0rk7/CVE-2012-2122-Home-Lab2025-11-24
PoC in GitHubCyberCTF/vulhub-mysql-cve-2012-21222026-10-08
MetasploitMySQL Authentication Bypass Password Dump2012-06-09
NucleiMySQL - Authentication Bypass

History

History
RecordedChangedSources
affected, exploits, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-2122 is a medium vulnerability (CVSS 5.1) in Mariadb, published June 18, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.6%, the 99th percentile. No source names a fixed version.

References

Show 89 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open