CVE-2004-2357 The embedded MySQL 4.0 server for Proofpoint Protection Server does not require a password for the root user of MySQL, which allows remote attackers to read or modify the backend database.

MediumCVSS 6.4 EPSS 1.4%

Published: 2005-08-16 07:00
Updated: 2026-06-17 01:09
Exploit status: No public exploit known

Description

The embedded MySQL 4.0 server for Proofpoint Protection Server does not require a password for the root user of MySQL, which allows remote attackers to read or modify the backend database.

Affected products

Product	Affected versions	Fixed in
proofpoint protection server	All versions	No fix listed

References

20040201 Proofpoint Protection Server remote MySQL root user vulnerability mailing-list
20040223 Re: [Full-Disclosure] Proofpoint Protection Server remote MySQL root user vulnerability mailing-list
proofpoint-mysql-gain-access(15280) vdb-entry

CVSS v2.0

6.4 Medium

AV:N/AC:L/Au:N/C:P/I:P/A:N

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.37% (percentile 72.4)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.