How severe is CVE-1999-1475?

CVE-1999-1475 has a CVSS 2.0 base score of 4.6, rated medium severity.

Is CVE-1999-1475 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (90th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-1999-1475?

CVE-1999-1475 affects Proftpd Project Proftpd. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-1999-1475?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-1999-1475 published?

CVE-1999-1475 was published on 1999-11-19 and last updated on 2026-06-16.

CVE-1999-1475

CVE-1999-1475 is a medium-severity vulnerability in Proftpd Project Proftpd with a CVSS 2.0 base score of 4.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 4.6)
EPSS exploit prediction: 4% (90th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Proftpd Project Proftpd
Published: 1999-11-19
Last modified: 2026-06-16

Description

ProFTPd 1.2 compiled with the mod_sqlpw module records user passwords in the wtmp log file, which allows local users to obtain the passwords and gain privileges by reading wtmp, e.g. via the last command.

Frequently asked questions

What is CVE-1999-1475?: ProFTPd 1.2 compiled with the mod_sqlpw module records user passwords in the wtmp log file, which allows local users to obtain the passwords and gain privileges by reading wtmp, e.g. via the last command.
How severe is CVE-1999-1475?: CVE-1999-1475 has a CVSS 2.0 base score of 4.6, rated medium severity.
Is CVE-1999-1475 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (90th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-1999-1475?: CVE-1999-1475 affects Proftpd Project Proftpd. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-1999-1475?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-1999-1475 published?: CVE-1999-1475 was published on 1999-11-19 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:proftpd_project:proftpd:1.2:*:*:*:*:*:*:*

More vulnerabilities in Proftpd Project Proftpd

CVE-2006-5815 — Critical (CVSS 10.0): Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably…
CVE-2003-0500 — Critical (CVSS 10.0): SQL injection vulnerability in the PostgreSQL authentication module (mod_sql_postgres) for ProFTPD before 1.2.9rc1…
CVE-1999-0911 — Critical (CVSS 10.0): Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and…
CVE-1999-0368 — Critical (CVSS 10.0): Buffer overflows in wuarchive ftpd (wu-ftpd) and ProFTPD lead to remote root access, a.k.a. palmetto.
CVE-2003-0831 — Critical (CVSS 9.0): ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode,…
CVE-2009-0542 — High (CVSS 7.5): SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL…

All CVEs affecting Proftpd Project Proftpd →