Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade mariadb-develUpgrade mariadb-libsUpgrade mariadb-embedded-develUpgrade mariadbUpgrade mariadb-embeddedUpgrade mariadb-testUpgrade mariadb-serverUpgrade mariadb-bench | Dec 1, 2016 | Dec 3, 2012 |
| Freebsd | — | Upgrade mariadb-serverUpgrade percona-serverUpgrade mysql-server | Dec 10, 2025 | Feb 1, 2013 |
| Gentoo Linux | — | Upgrade dev-db/mysql. | Oct 30, 2017 | Dec 3, 2012 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | Dec 3, 2012 |
| Oracle Mysql | — | Upgrade to the latest version of MySQL | Oct 23, 2014 | Dec 3, 2012 |
| Oracle Solaris | — | Upgrade entire to version 0.5.11-0.175.3.0.0.30.0 on Solaris 11.3 | May 29, 2017 | Dec 3, 2012 |
| Suse | — | Upgrade libmysqlclient_r15-32bitUpgrade libmysqlclient18-32bitUpgrade mariadb-toolsUpgrade libmariadb3Upgrade libmysqlclient_r15Upgrade libmysqlclient_r18-32bitUpgrade libmysqlclient_r18Upgrade libmariadb_pluginsUpgrade libmariadbd-develUpgrade mariadbUpgrade libmysqld19Upgrade mysql-MaxUpgrade libmysqld18Upgrade libmariadbd104-develUpgrade mysql-clientUpgrade mariadb-benchUpgrade mariadb104-rpm-macrosUpgrade libmysql55client_r18-x86Upgrade libmysqlclient-develUpgrade liblz4-1Upgrade mysqlUpgrade mariadb-clientUpgrade libmysqlclient15Upgrade mariadb104-errormessagesUpgrade libmariadb-develUpgrade libmysqlclient_r15-x86Upgrade libmariadbd19Upgrade mariadb104-testUpgrade libmysqlclient18Upgrade libmysql55client18-32bitUpgrade libmysql55client18-x86Upgrade libmysqld-develUpgrade mariadb104-toolsUpgrade mariadb104Upgrade mariadb104-benchUpgrade mariadb-100-errormessagesUpgrade mariadb-errormessagesUpgrade libmysqlclient15-x86Upgrade python3-mysqlclientUpgrade libmysql55client_r18-32bitUpgrade mariadb104-galeraUpgrade libmysql55client18Upgrade mariadb104-clientUpgrade libmysqlclient15-32bitUpgrade mysql-toolsUpgrade libmysql55client_r18 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade mysql-server-5.5 | Nov 8, 2024 | Dec 3, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub