SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21414
Key Information:
Summary
The SQL Server Native Client OLE DB Provider contains a vulnerability that allows for remote code execution. An attacker could exploit this flaw by sending a specially crafted request to the affected server, leading to unintended code execution within the affected product. This vulnerability affects several versions of SQL Server Native Client, thereby posing significant risks to data integrity and system security if unaddressed. Organizations utilizing these affected versions should prioritize updates and mitigations outlined in Microsoft’s advisory.
Affected Version(s)
Microsoft SQL Server 2016 Service Pack 3 (GDR) x64-based Systems 13.0.0 < 13.0.6441.1
Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack x64-based Systems 13.0.0 < 13.0.7037.1
Microsoft SQL Server 2017 (CU 31) x64-based Systems 14.0.0 < 14.0.3471.2
References
EPSS Score
0% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
Vulnerability published