Untrusted Pointer Dereference (CWE-822)
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. This is a network-based vulnerability with low attack complexity and requires low privileges. It does not require user interaction. The vulnerability affects multiple versions of Microsoft SQL Server, including SQL Server 2016, 2017, 2019, 2022, and SQL 2016 Azure Connect Feature Pack.
This vulnerability has a high impact on confidentiality, integrity, and availability. Successful exploitation could allow an attacker to execute arbitrary code remotely on the affected SQL Server system, potentially leading to full system compromise. The attacker could potentially access, modify, or delete sensitive data, disrupt services, or use the compromised system as a launching point for further attacks within the network. The vulnerability has a CVSS base score of 8.8, indicating a high severity level.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. Microsoft has released an official fix for this vulnerability on September 10, 2024. Affected versions include: - SQL Server 2017: versions 14.0.1000.169 to 14.0.2060.1 and 14.0.3006.16 to 14.0.3475.1 - SQL Server 2019: versions 15.0.2000.5 to 15.0.2120.1 and 15.0.4003.23 to 15.0.4390.2 - SQL 2016 Azure Connect Feature Pack: versions 13.0.7000.253 to 13.0.7037.1 - SQL Server 2016: versions 13.0.6300.2 to 13.0.6441.1 - SQL Server 2022: versions 16.0.1000.6 to 16.0.1125.1 and 16.0.4003.1 to 16.0.4140.3
1. Apply the official patch released by Microsoft as soon as possible. 2. Limit network access to SQL Server instances, especially from untrusted networks. 3. Implement the principle of least privilege for SQL Server accounts. 4. Monitor SQL Server logs for unusual activities. 5. Keep SQL Server and all related components up to date with the latest security patches. 6. Consider using additional security measures such as firewalls and intrusion detection systems to protect SQL Server instances.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Detection for the vulnerability has been added to Qualys (380469)
A CVSS base score of 8.8 has been assigned.
Feedly found the first article mentioning CVE-2024-37340. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-37340
EPSS Score was set to: 0.05% (Percentile: 20%)
Detection for the vulnerability has been added to Nessus (207067)
Detection for the vulnerability has been added to Nessus (207069)
EPSS Score was set to: 0.05% (Percentile: 17.5%)