← Back

CVE-2002-1872

nvd nist
Published: Dec 31, 2002Modified: Apr 16, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

Microsoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password encryption (XOR), which allows remote attackers to sniff and decrypt the password.

Affected (10)

Microsoft
1 product
Sql Server
Configuration A
10 vulnerable
Vulnerable SoftwareAffected Versions
Microsoft
Sql Server
Version 2000
Sql Server
Version 2000 sp1
Sql Server
Version 2000 sp2
Sql Server
Version 6.0
Sql Server
Version 6.5
Sql Server
Version 7.0
Sql Server
Version 7.0 sp1
Sql Server
Version 7.0 sp2
Sql Server
Version 7.0 sp3
Sql Server
Version 7.0 sp4

Related CWEs

CWE-326
Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (8)

Source: cve@mitre.org
Broken LinkThird Party AdvisoryVDB EntryVendor Advisory
Source: cve@mitre.org
Broken Link
Source: cve@mitre.org
Broken Link
Source: cve@mitre.org
Broken LinkThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkThird Party AdvisoryVDB EntryVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkThird Party AdvisoryVDB Entry

Timeline

No history available yet.