CVE-2012-5615: Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possi...

Security readout for executives and security teams

This flaw lets a remote attacker learn whether MySQL or MariaDB usernames are valid by comparing login error behavior and timing. It does not directly grant database access, but it reduces guesswork for later password attacks against exposed or poorly restricted database services. Exposure is most relevant where affected MySQL or MariaDB versions accept remote connections, especially from untrusted networks. Internal-only databases still matter if reachable by compromised hosts or broad corporate networks. Treat this as a hardening and exposure-reduction issue, not an emergency remote-code-execution event. Prioritize internet-facing or legacy database servers first because enumeration can support credential attacks. Mitigation focus: Identify all MySQL and MariaDB instances and their versions.; Upgrade affected databases using Oracle, MariaDB, or distribution vendor guidance.; Restrict database access to required application hosts only..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.