SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-37324

8.8HIGH

Summary

The SQL Server Native Client OLE DB Provider has a vulnerability that could allow an attacker to execute arbitrary code on the host machine. This remote code execution flaw may result in unauthorized access and control over affected systems, enabling cyber threats that could compromise data integrity and confidentiality. Organizations using SQL Server and OLE DB technology should take immediate steps to assess their systems and apply any relevant security patches to mitigate potential risks. The vulnerability underscores the importance of proactive cybersecurity measures in safeguarding enterprise environments.

Affected Version(s)

Microsoft SQL Server 2016 Service Pack 3 (GDR) x64-based Systems 13.0.0 < 13.0.6441.1

Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack x64-based Systems 13.0.0 < 13.0.7037.1

Microsoft SQL Server 2017 (CU 31) x64-based Systems 14.0.0 < 14.0.3471.2

References

EPSS Score

0% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

Collectors

NVD DatabaseMitre DatabaseMicrosoft Feed
.