Every CVE Search/ Get API key

CVE-2012-5613

** DISPUTED ** MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other...

6.0 MediumPublic exploitDisputed

MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.

Exploit likelihood

31.7%Down 59.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.0

MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.

Record
CVE-2012-5613
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness
CWE-16
Updated
2026-11-02
CVE List No score

MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.

Record
CVE-2012-5613
Updated
2026-11-02
EUVDEUVD-2012-5499 No score

MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.

Record
EUVD-2012-5499
Updated
2026-11-03
GitHub AdvisoriesGHSA-cvqp-6rwh-x2fj No score

** DISPUTED ** MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other...

** DISPUTED ** MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.

Record
GHSA-cvqp-6rwh-x2fj
Updated
2026-11-02
OSVBELL-CVE-2012-5613 6.0

CVE-2012-5613 does not affect BellSoft software

Record
BELL-CVE-2012-5613
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Updated
2026-11-02
OSVSUSE-SU-2015:1177-2 No score

Security update for MySQL

A stack-based buffer overflow in MySQL has been fixed that could have caused a Denial of Service or potentially allowed the execution of arbitrary code (CVE-2012-5611).

Security Issue references:

* CVE-2012-5615
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5615>
* CVE-2012-5615
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5615>
* CVE-2012-5613
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5613>
* CVE-2012-5612
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5612>
* CVE-2012-5611
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5611>
Record
SUSE-SU-2015:1177-2
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBMySQL (Linux) - Database Privilege Escalation2012-12-02
Exploit-DBOracle MySQL (Windows) - MOF Execution (Metasploit)2012-12-06
Exploit-DBOracle MySQL (Windows) - FILE Privilege Abuse (Metasploit)2015-01-13
MetasploitOracle MySQL for Microsoft Windows MOF Execution2012-12-01
MetasploitOracle MySQL for Microsoft Windows FILE Privilege Abuse2012-12-01
PoC in GitHubHood3dRob1n/MySQL-Fu.rb2013-02-09
PoC in GitHubw4fz5uck5/UDFPwn-CVE-2012-56132018-06-14

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-5613 is a medium vulnerability (CVSS 6.0) in Mariadb, published December 3, 2012. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 31.7%, the 98th percentile.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open