{"id":"CVE-2012-5613","aliases":["BELL-CVE-2012-5613","EUVD-2012-5499","GHSA-cvqp-6rwh-x2fj","SUSE-SU-2015:1177-2"],"status":"disputed","title":"** DISPUTED **  MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other...","description":"MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.","severity":{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.31664,"percentile":0.98306,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-16"],"published":"2012-12-03T00:00:00Z","modified":"2026-06-16T23:47:05Z","exploits":[{"source":"metasploit","id":"exploit/windows/mysql/mysql_mof","title":"Oracle MySQL for Microsoft Windows MOF Execution","type":"exploit","platform":"Windows","date":"2012-12-01","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/mysql/mysql_mof"},{"source":"metasploit","id":"exploit/windows/mysql/mysql_start_up","title":"Oracle MySQL for Microsoft Windows FILE Privilege Abuse","type":"exploit","platform":"Windows","date":"2012-12-01","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/mysql/mysql_start_up"},{"source":"exploitdb","id":"EDB-23077","title":"MySQL (Linux) - Database Privilege Escalation","type":"local","platform":"linux","date":"2012-12-02","verified":true,"url":"https://www.exploit-db.com/exploits/23077"},{"source":"exploitdb","id":"EDB-23179","title":"Oracle MySQL (Windows) - MOF Execution (Metasploit)","type":"remote","platform":"windows","date":"2012-12-06","verified":true,"url":"https://www.exploit-db.com/exploits/23179"},{"source":"pocgithub","id":"Hood3dRob1n/MySQL-Fu.rb","title":"Hood3dRob1n/MySQL-Fu.rb","date":"2013-02-09","url":"https://github.com/Hood3dRob1n/MySQL-Fu.rb"},{"source":"exploitdb","id":"EDB-35777","title":"Oracle MySQL (Windows) - FILE Privilege Abuse (Metasploit)","type":"remote","platform":"windows","date":"2015-01-13","verified":true,"url":"https://www.exploit-db.com/exploits/35777"},{"source":"pocgithub","id":"w4fz5uck5/UDFPwn-CVE-2012-5613","title":"w4fz5uck5/UDFPwn-CVE-2012-5613","date":"2018-06-14","url":"https://github.com/w4fz5uck5/UDFPwn-CVE-2012-5613"}],"products":[{"vendor":"mariadb","product":"mariadb"},{"vendor":"oracle","product":"mysql"}],"references":[{"url":"http://secunia.com/advisories/53372","tags":["third-party-advisory","x_transferred","Broken Link"]},{"url":"http://www.openwall.com/lists/oss-security/2012/12/02/3","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://security.gentoo.org/glsa/glsa-201308-06.xml","tags":["vendor-advisory","x_transferred","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2012/12/02/4","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2012/Dec/6","tags":["mailing-list","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5613"},{"url":"https://github.com/advisories/GHSA-cvqp-6rwh-x2fj"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2012-5613","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151177-2/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/792444","tags":["report"]},{"url":"https://bugzilla.suse.com/934789","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4000","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-5613","description":"MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.","status":"disputed","published":"2012-12-03T00:00:00Z","modified":"2024-08-06T21:14:16.077Z","updated_at":"2026-11-02T14:34:49.246229Z"}],"euvd":[{"id":"EUVD-2012-5499","description":"MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.","status":"published","published":"2012-12-03T00:00:00Z","modified":"2024-08-06T21:14:16Z","updated_at":"2026-11-03T01:56:04.46975Z"}],"ghsa":[{"id":"GHSA-cvqp-6rwh-x2fj","title":"** DISPUTED **  MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other...","description":"** DISPUTED **  MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator.  NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation.  NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.","status":"published","published":"2022-05-17T04:52:31Z","modified":"2023-01-28T05:02:41Z","updated_at":"2026-11-02T14:43:49.735086Z"}],"nvd":[{"id":"CVE-2012-5613","description":"MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.","status":"disputed","published":"2012-12-03T12:49:43.643Z","modified":"2026-06-16T23:47:05.46Z","cvss":[{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-16"],"updated_at":"2026-11-02T14:02:16.958223Z"}],"osv":[{"id":"BELL-CVE-2012-5613","title":"CVE-2012-5613 does not affect BellSoft software","status":"withdrawn","published":"2012-12-03T12:49:00Z","modified":"2026-01-28T07:19:24.919099Z","cvss":[{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"SUSE-SU-2015:1177-2","title":"Security update for MySQL","description":"\nA stack-based buffer overflow in MySQL has been fixed that could have \ncaused a Denial of Service or potentially allowed the execution of \narbitrary code (CVE-2012-5611).\n\nSecurity Issue references:\n\n    * CVE-2012-5615\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5615\u003e\n    * CVE-2012-5615\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5615\u003e\n    * CVE-2012-5613\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5613\u003e\n    * CVE-2012-5612\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5612\u003e\n    * CVE-2012-5611\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5611\u003e\n\n","status":"published","published":"2012-12-27T16:15:49Z","modified":"2026-02-04T03:58:21.906233Z","updated_at":"2026-11-02T15:53:43.030986Z"}]}}