VDB
CVE-2002-0643
CVE-2002-0643
PUBLISHED
CVSS 4.599999904632568 MEDIUM
The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain privileges, aka "SQL Server Installation Process May Leave Passwords on System."
EPSS 0.53% · 67.5th percentile
Risk Scores
CVSS 2.0
4.599999904632568
EPSS Score
0.53%
67.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| microsoft | data_engine | 1.0 |
| n/a | n/a | n/a |
| microsoft | sql_server | 7.0, 7.0, 7.0 |
Timeline
- Jul 12, 2002 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- May 26, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
References
- 20020711 SQL Server 7 & 2000 Installation process and Service Packs write encoded passwords to a file mailing-list
- MS02-035 vendor-advisory
- 20020711 SQL Server 7 & 2000 Installation process and Service Packs write encoded passwords to a file mailing-list
- VU#338195 third-party-advisory
- 5203 vdb
- https://nvd.nist.gov/vuln/detail/CVE-2002-0643 advisory