vulnwire
7.5high

CVE-2002-1872

Microsoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password encryption (XOR), which allows remote attackers…

Published 23 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
7.0%
percentile 94%
Public exploits
0
none known

Microsoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password encryption (XOR), which allows remote attackers to sniff and decrypt the password.

Exploit prediction (EPSS)

6.98% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-326 Inadequate Encryption Strength
Technology feeds
Microsoft SQL Server (RSS, critical only)

References

  • securityfocus.com /bid/6097 · vdb-entry, x_refsource_BID, x_transferred
  • iss.net /security_center/static/10542.php · vdb-entry, x_refsource_XF, x_transferred
  • online.securityfocus.com /archive/1/298361 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • nextgenss.com /papers/tp-SQL2000.pdf · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.