Vulnerability Details : CVE-2004-1228
The install scripts in SugarCRM Sugar Sales 2.0.1c and earlier are not removed after installation, which allows attackers to obtain the MySQL administrative password in cleartext from an installation form, or to cause a denial of service by changing database settings to the default.
Vulnerability category: Denial of service
Products affected by CVE-2004-1228
- cpe:2.3:a:sugarcrm:sugar_sales:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2004-1228
0.41%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 58 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2004-1228
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:P |
10.0
|
4.9
|
NIST |
References for CVE-2004-1228
-
http://marc.info/?l=bugtraq&m=110295433323795&w=2
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/18449
Sugar Sales plaintext MySQL password CVE-2004-1228 Vulnerability Report
Jump to