Out-of-bounds Read (CWE-125)
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. This is a network-based vulnerability with low attack complexity and requires low privileges. It does not require user interaction and has high impacts on confidentiality, integrity, and availability.
This vulnerability allows an attacker to execute arbitrary code remotely on affected Microsoft SQL Server systems. The high impact on confidentiality, integrity, and availability suggests that an attacker could potentially access, modify, or delete sensitive data, disrupt database operations, or take control of the affected system.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. Microsoft has released an official fix for this vulnerability.
1. Apply the official patch released by Microsoft as soon as possible. 2. Limit network access to SQL Server instances, especially from untrusted networks. 3. Implement the principle of least privilege for SQL Server accounts. 4. Monitor SQL Server logs for unusual activity. 5. Keep SQL Server and related components up to date with the latest security updates.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Detection for the vulnerability has been added to Qualys (380469)
A CVSS base score of 8.8 has been assigned.
Feedly found the first article mentioning CVE-2024-37338. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-37338
EPSS Score was set to: 0.05% (Percentile: 20%)
Detection for the vulnerability has been added to Nessus (207067)
Detection for the vulnerability has been added to Nessus (207069)
EPSS Score was set to: 0.05% (Percentile: 17.5%)