Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Crystal Reports exposes database passwords in web pages

CVE-2001-1464 · published 25 years ago
Summary

Crystal Reports can place the database username and password in plain text within the HTML page and its URL when showing data from a password‑protected database. This lets anyone who can view the page see the credentials, potentially giving them unauthorized access to the database. Update to a patched version of Crystal Reports or change the configuration to stop embedding credentials in the page.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
businessobjects crystal_reports All versions
cpe:2.3:a:businessobjects:crystal_reports:*:*:*:*:*:*:*:*
Original advisory text
Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and the URL, which allows remote attackers t...
Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and the URL, which allows remote attackers to obtain passwords.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
4% chance of attack within 30 days
Timeline
Published10 Jan 2001
Updated24 Oct 2026
First seen29 Sep 2026
Sources
CVE-2001-1464 · NVD
Track software like this
Free during beta