CVE-2024-37339

CVSS 8.8v3.1pub. 2024-09-10upd. 2024-09-23

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

oryginał EN

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Microsoft Sql 2016 Azure Connect Feature Pack
APP
Microsoft
13.0.7000.253 – 13.0.7037.1
Microsoft Sql Server 2016
APP
Microsoft
13.0.6300.2 – 13.0.6441.1 (bez)
Microsoft Sql Server 2017
APP
Microsoft
14.0.1000.169 – 14.0.2060.1 (bez)14.0.3006.16 – 14.0.3475.1 (bez)
Microsoft Sql Server 2019
APP
Microsoft
15.0.2000.5 – 15.0.2120.1 (bez)15.0.4003.23 – 15.0.4390.2 (bez)
Microsoft Sql Server 2022
APP
Microsoft
16.0.1000.6 – 16.0.1125.1 (bez)16.0.4003.1 – 16.0.4140.3 (bez)

🟢

PATCH DOSTĘPNY

Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.

Tagi

RCE

CWE

Referencje

Powiązane podatności

External control of file name or path in SQL Server allows an authorized attacker to execute code over a netwo...

Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileg...

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an a...