CVE Catalog
CVE-1999-1475
MediumExploitation Probability (EPSS)
Very high risk4.47%
90th percentile - higher than 90% of all known CVEs
Summary
ProFTPd 1.2 compiled with the mod_sqlpw module records user passwords in the wtmp log file, allowing local users to obtain passwords and gain privileges by reading wtmp, e.g., via the last command.
Risk Assessment
Local users can access other users' passwords, leading to potential privilege escalation and security breaches.
Recommendation
It is recommended to update ProFTPd to the latest version and disable password logging in the wtmp file to minimize risk.
Original NVD description (English source)
ProFTPd 1.2 compiled with the mod_sqlpw module records user passwords in the wtmp log file, which allows local users to obtain the passwords and gain privileges by reading wtmp, e.g. via the last command.