CVE-2004-1228 Information disclosure in n/a
Attackers can access cleartext MySQL passwords or cause denial of service via exposed installation scripts in SugarCRM Sales.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2004-1228?
CVE-2004-1228 is a medium-severity vulnerability in n/a, published on 15 Dec 2004. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The install scripts in SugarCRM Sugar Sales 2.0.1c and earlier are not removed after installation, which allows attackers to obtain the MySQL administrative password in cleartext from an installation form, or to cause a denial of service by changing database settings to the default.
Which versions are affected by CVE-2004-1228?
It affects 1 product.
Products include Sugarcrm Sugar Sales.
How do I fix CVE-2004-1228?
No fix has been published for CVE-2004-1228 yet. Limit exposure of the affected software until one is available.
Is CVE-2004-1228 being exploited?
There is no known exploitation of CVE-2004-1228 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-qwhf-v44r-h4m2.