CVE-2015-3001 - SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password

Back Back to CVE browser

MEDIUM

SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password

Published Jun 8, 2015

5.0

MEDIUM

CVSS 2.0

EPSS 6.78%

Description

SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-255

References (6)

http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html
x_refsource_MISCExploit
http://seclists.org/fulldisclosure/2015/Jun/8
mailing-listx_refsource_FULLDISCExploit
http://www.securityfocus.com/archive/1/535679/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/75035
vdb-entryx_refsource_BID
https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-3083
Advisory
https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html		x_refsource_MISCExploit
http://seclists.org/fulldisclosure/2015/Jun/8		mailing-listx_refsource_FULLDISCExploit
http://www.securityfocus.com/archive/1/535679/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/75035		vdb-entryx_refsource_BID
https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-3083		Advisory
https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk		x_refsource_CONFIRMVendor Advisory