CVE-2000-0199
HighExploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
When a new SQL Server is registered in Enterprise Manager for Microsoft SQL Server 7.0 and the 'Always prompt for login name and password' option is not set, then the Enterprise Manager uses weak encryption to store the login ID and password.
Risk Assessment
Weak encryption may lead to unauthorized access to data, posing a serious security threat to the organization.
Recommendation
It is recommended to enable the 'Always prompt for login name and password' option and consider upgrading to a newer version of SQL Server with better security mechanisms.
Other vulnerabilities in Microsoft SQL Server 7.0
See all- CVE-2016-7249High
Microsoft SQL Server 2016 does not properly perform a cast of an unspecified pointer, allowing remote authenticated users to gain privileges via unknown vectors.
- CVE-2019-1068HighActively exploited
A remote code execution vulnerability exists in Microsoft SQL Server due to improper handling of internal functions. An attacker could exploit it to execute arbitrary code on the server.
- CVE-2000-0402Low
The vulnerability in Microsoft SQL Server 7.0 allows the Mixed Mode authentication mechanism to store the System Administrator (sa) account password in plaintext in a log file, which is accessible to any user.
- CVE-1999-0999Medium
Microsoft SQL 7.0 server allows a remote attacker to cause a denial of service via a malformed TDS packet.
- CVE-2024-43474High
Information disclosure vulnerability in Microsoft SQL Server. Could allow an attacker to gain access to sensitive data.
- CVE-2024-37980High
Elevation of privilege vulnerability in Microsoft SQL Server. It allows an attacker to gain higher privileges on the system.
- CVE-2024-37966High
Information disclosure vulnerability in Microsoft SQL Server Native Scoring. It may allow an attacker to gain unauthorized access to data.
- CVE-2024-37965High
A vulnerability in Microsoft SQL Server allows elevation of privilege. An attacker could exploit this flaw to gain higher privileges in the database.
- CVE-2024-37341High
Elevation of privilege vulnerability in Microsoft SQL Server. It allows an attacker to gain higher privileges on the system.
- CVE-2024-37340High
Remote code execution vulnerability in Microsoft SQL Server Native Scoring. An attacker could exploit this flaw to execute arbitrary code in the SQL Server service context.
Original NVD description (English source)
When a new SQL Server is registered in Enterprise Manager for Microsoft SQL Server 7.0 and the "Always prompt for login name and password" option is not set, then the Enterprise Manager uses weak encryption to store the login ID and password.