CVE-2002-1479

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2002-09/0028.htmlExploit, Patch, Vendor Advisory
http://www.iss.net/security_center/static/10049.phpPatch, Vendor Advisory
http://www.knights-of-the-routing-table.org/advisories/krt_001_20020903_cacti.txtURL Repurposed
http://www.securityfocus.com/bid/5628Patch, Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2002-09/0028.htmlExploit, Patch, Vendor Advisory
http://www.iss.net/security_center/static/10049.phpPatch, Vendor Advisory
http://www.knights-of-the-routing-table.org/advisories/krt_001_20020903_cacti.txtURL Repurposed
http://www.securityfocus.com/bid/5628Patch, Vendor Advisory

Timeline

Published: Apr 22, 2003
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-14806.8Cross-site scripting (XSS) vulnerability in phpGB before 1.20 allows remote attackers to inject arbitrary HTML or script into guestbook page CVE-2002-14817.5savesettings.php in phpGB 1.20 and earlier does not require authentication, which allows remote attackers to cause a denial of service or ex CVE-2002-148210.0SQL injection vulnerability in login.php for phpGB 1.20 and earlier, when magic_quotes_gpc is not enabled, allows remote attackers to gain a CVE-2002-14835.0db4web_c and db4web_c.exe programs in DB4Web 3.4 and 3.6 allow remote attackers to read arbitrary files via an HTTP request whose argument i CVE-2002-14849.8DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections t CVE-2002-14855.0The AIM component of Trillian 0.73 and 0.74 allows remote attackers to cause a denial of service (crash) via certain strings such as "P > O CVE-2002-14867.5Multiple buffer overflows in the IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service an CVE-2002-14875.0The IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service (crash) by sending the raw mess CVE-2002-14885.0The IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service (crash) via a PART message with CVE-2002-14897.5Buffer overflow in PlanetDNS PlanetWeb 1.14 and earlier allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a CVE-2002-14902.1NetBSD 1.4 through 1.6 beta allows local users to cause a denial of service (kernel panic) via a series of calls to the TIOCSCTTY ioctl, whi CVE-2002-14915.0The Cisco VPN 5000 Client for MacOS before 5.2.2 records the most recently used login password in plaintext when saving "Default Connection"