How severe is CVE-2004-1610?

CVE-2004-1610 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2004-1610 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (81st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2004-1610?

CVE-2004-1610 primarily affects Best Software Saleslogix. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2004-1610?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2004-1610 published?

CVE-2004-1610 was published on 2004-10-18 and last updated on 2026-06-16.

CVE-2004-1610

CVE-2004-1610 is a high-severity vulnerability in Best Software Saleslogix with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 2.0 base score 7.5)
EPSS exploit prediction: 2% (81st percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Best Software Saleslogix
Published: 2004-10-18
Last modified: 2026-06-16

Description

SalesLogix 6.1 uses client-specified pathnames for writing certain files, which might allow remote authenticated users to create arbitrary files and execute code via the (1) vMME.AttachmentPath or (2) vMME.LibraryPath variables.

Frequently asked questions

What is CVE-2004-1610?: SalesLogix 6.1 uses client-specified pathnames for writing certain files, which might allow remote authenticated users to create arbitrary files and execute code via the (1) vMME.AttachmentPath or (2) vMME.LibraryPath variables.
How severe is CVE-2004-1610?: CVE-2004-1610 has a CVSS 2.0 base score of 7.5, rated high severity.
Is CVE-2004-1610 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (81st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2004-1610?: CVE-2004-1610 primarily affects Best Software Saleslogix. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2004-1610?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2004-1610 published?: CVE-2004-1610 was published on 2004-10-18 and last updated on 2026-06-16.

References

http://marc.info/?l=bugtraq&m=109811852218478&w=2

Affected products (2)

cpe:2.3:a:best_software:saleslogix:*:*:*:*:*:*:*:*
cpe:2.3:a:saleslogix_corporation:saleslogix:2000.0:*:*:*:*:*:*:*

More vulnerabilities in Best Software Saleslogix

CVE-2004-1608 — High (CVSS 7.5): SQL injection vulnerability in SalesLogix 6.1 allows remote attackers to execute arbitrary SQL statements via the id…
CVE-2004-1605 — High (CVSS 7.5): SalesLogix 6.1 allows remote attackers to bypass authentication by modifying the slxweb cookie to set user=Admin,…
CVE-2004-1606 — Medium (CVSS 6.4): slxweb.dll in SalesLogix 6.1 allows remote attackers to cause a denial service (application crash) via an invalid HTTP…
CVE-2004-1611 — Medium (CVSS 5.1): SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow…
CVE-2004-1609 — Medium (CVSS 5.0): SalesLogix 6.1 includes usernames, passwords, and other sensitive information in the headers of an HTTP response, which…
CVE-2004-1607 — Medium (CVSS 5.0): slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a (1) Library or (2)…

All CVEs affecting Best Software Saleslogix →