How severe is CVE-2019-12301?

CVE-2019-12301 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2019-12301 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (78th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-12301?

CVE-2019-12301 affects Percona Percona Server. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2019-12301?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2019-12301 published?

CVE-2019-12301 was published on 2019-05-23 and last updated on 2026-06-17.

CVE-2019-12301

CVE-2019-12301 is a critical-severity vulnerability in Percona Percona Server with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 10.0
EPSS exploit prediction: 2% (78th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Percona Percona Server
Published: 2019-05-23
Last modified: 2026-06-17

Description

The Percona Server 5.6.44-85.0-1 packages for Debian and Ubuntu suffered an issue where the server would reset the root password to a blank value upon an upgrade. This was fixed in 5.6.44-85.0-2.

Frequently asked questions

What is CVE-2019-12301?: The Percona Server 5.6.44-85.0-1 packages for Debian and Ubuntu suffered an issue where the server would reset the root password to a blank value upon an upgrade. This was fixed in 5.6.44-85.0-2.
How severe is CVE-2019-12301?: CVE-2019-12301 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2019-12301 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (78th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-12301?: CVE-2019-12301 affects Percona Percona Server. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2019-12301?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2019-12301 published?: CVE-2019-12301 was published on 2019-05-23 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:percona:percona_server:5.6.44-85.0-1:*:*:*:*:*:*:*

More vulnerabilities in Percona Percona Server

CVE-2020-26542 — Critical (CVSS 9.8): An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using the…
CVE-2016-6662 — Critical (CVSS 9.8): Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before…
CVE-2022-34968 — High (CVSS 7.5): An issue in the fetch_step function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of…
CVE-2021-27928 — High (CVSS 7.2): A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18,…
CVE-2016-6664 — High (CVSS 7.0): mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server…
CVE-2016-6663 — High (CVSS 7.0): Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB…

All CVEs affecting Percona Percona Server →