Login Request a demo
Unscored severity · published May 5, 2004
CVE-2004-1997
Kolab stores OpenLDAP passwords in plaintext in the slapd.conf file, which may be installed world-readable, which allows local users to gain privileges
–
CVSS
0.4%
EPSS
No
On KEV
Description
Kolab stores OpenLDAP passwords in plaintext in the slapd.conf file, which may be installed world-readable, which allows local users to gain privileges.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KG
Kolab Groupware Server · Kolab
1.0; 1.0.1; 1.0.3; 1.0.5; 1.0.6; 1.0.7; +1 more · source: NVD
OP
Openpkg · Openpkg
2.0 · source: NVD
Affected product
KG
Kolab Groupware Server
Kolab
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1997
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1997
marc.info
http://marc.info/?l=bugtraq&m=108377525924422&w=2
Exploit
http://secunia.com/advisories/11560
www.erfrakon.de
http://www.erfrakon.de/projects/kolab/download/kolab-server-1.0/src/Changelog
Exploit
http://www.kolab.org/pipermail/kolab-users/2004-April/000215.html
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDKSA-2004:052
www.osvdb.org
http://www.osvdb.org/5898
More from Kolab Groupware Server
–
CVE-2008-4165
admin/user/create_user.php in Kolab Groupware Server 1.0.0 places a user password in an HTTP GET request, which allows local administrators, and possibly remote attackers, to…
–
CVE-2006-0213
Kolab Server 2.0.1, 2.0.2 and development versions pre-2.1-20051215 and earlier, when authenticating users via secure SMTP, stores authentication credentials in plaintext in the…
–
CVE-2005-4828
Kolab Server 2.0.0 and 2.0.1 does not properly handle when a large email is sent with a "." in the wrong place, which causes kolabfilter to add another ".", which might break…