Unscored severity · published Dec 31, 2002
CVE-2002-2043
SQL injection vulnerability in the LDAP and MySQL authentication patch for Cyrus SASL 1.5.24 and 1.5.27 allows remote attackers to execute arbitrary SQL commands and log in as…
–
CVSS
1.3%
EPSS
No
On KEV
Description
SQL injection vulnerability in the LDAP and MySQL authentication patch for Cyrus SASL 1.5.24 and 1.5.27 allows remote attackers to execute arbitrary SQL commands and log in as arbitrary POP mail users via the password.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Sasl · Cyrus
1.5.24; 1.5.27 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-2043
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-2043
Patch
http://archives.neohapsis.com/archives/bugtraq/2002-04/0020.html
Patch
http://www.iss.net/security_center/static/8748.php
Patch
http://www.securityfocus.com/bid/4409
More from Sasl
–
CVE-2006-1721
digestmd5.c in the CMU Cyrus Simple Authentication and Security Layer (SASL) library 2.1.18, and possibly other versions before 2.1.21, allows remote unauthenticated attackers to…
–
CVE-2004-0884
The (1) libsasl and (2) libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASL_PATH environment variable to find all available SASL plug-ins, which allows local users…
–
CVE-2005-0373
Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows…