Description
SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1) execute arbitrary SLX commands on the server or spoof the server via a man-in-the-middle (MITM) attack, or (2) obtain the database password via a GetConnection request to TCP port 1707.
References
- 12883 third-party-advisory
- 20041018 Multiple vulnerabilities in Sage Saleslogix mailing-list
- 10948 vdb-entry
- 10947 vdb-entry
- 1011769 vdb-entry
- 11450 vdb-entry
- saleslogix-getconnection-account-disclosure(17754) vdb-entry
- 20041018 Multiple vulnerabilities in Sage Saleslogix mailing-list