CVE-2024-37341

Improper Access Control (CWE-284)

Published: Sep 10, 2024

010
CVSS 8.8EPSS 0.05%High
CVE info copied to clipboard

Summary

Microsoft SQL Server Elevation of Privilege Vulnerability. This is a network-based vulnerability with low attack complexity and requires low privileges to exploit. It does not require user interaction. The vulnerability affects multiple versions of Microsoft SQL Server, including SQL Server 2016, 2017, 2019, and 2022, as well as SQL 2016 Azure Connect Feature Pack.

Impact

The vulnerability has a high impact on confidentiality, integrity, and availability. Successful exploitation could allow an attacker to gain elevated privileges within the Microsoft SQL Server environment, potentially leading to unauthorized access to sensitive data, modification of database contents, or disruption of database services. Given the CVSS base score of 9.8, this vulnerability is considered critical and should be prioritized for patching.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Microsoft released an official fix for this vulnerability on September 10, 2024. The following versions are affected and should be updated: - SQL 2016 Azure Connect Feature Pack: versions 13.0.7000.253 to 13.0.7040.1 (exclusive) - SQL Server 2016: versions 13.0.6300.2 to 13.0.6441.1 (exclusive) - SQL Server 2017: versions 14.0.1000.169 to 14.0.2060.1 (exclusive) and 14.0.3006.16 to 14.0.3475.1 (exclusive) - SQL Server 2019: versions 15.0.2000.5 to 15.0.2120.1 (exclusive) and 15.0.4003.23 to 15.0.4390.2 (exclusive) - SQL Server 2022: versions 16.0.1000.6 to 16.0.1125.1 (exclusive) and 16.0.4003.1 to 16.0.4140.3 (exclusive)

Mitigation

1. Apply the official patch released by Microsoft as soon as possible to all affected SQL Server instances. 2. Limit network access to SQL Server instances, allowing connections only from trusted sources. 3. Implement the principle of least privilege for SQL Server user accounts. 4. Monitor SQL Server logs for suspicious activities that might indicate exploitation attempts. 5. Keep SQL Server and related systems up-to-date with the latest security patches. 6. If immediate patching is not possible, consider implementing additional network segmentation or access controls to reduce the risk of exploitation.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Timeline

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (380469)

Sep 10, 2024 at 7:53 AM
CVSS

A CVSS base score of 8.8 has been assigned.

Sep 10, 2024 at 4:55 PM / microsoft
First Article

Feedly found the first article mentioning CVE-2024-37341. See article

Sep 10, 2024 at 5:00 PM / Microsoft Security Advisories - MSRC
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 10, 2024 at 5:01 PM
CVE Assignment

NVD published the first details for CVE-2024-37341

Sep 10, 2024 at 5:15 PM
EPSS

EPSS Score was set to: 0.05% (Percentile: 20%)

Sep 11, 2024 at 10:12 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (207068)

Sep 12, 2024 at 5:15 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (207065)

Sep 12, 2024 at 5:15 PM
CVSS

A CVSS base score of 9.8 has been assigned.

Sep 23, 2024 at 4:40 PM / nvd
Static CVE Timeline Graph

Affected Systems

Microsoft/sql_server_2019
+null more

Patches

Microsoft
+null more

Links to Mitre Att&cks

T1546.004:
+null more

Attack Patterns

CAPEC-19: Embedding Scripts within Scripts
+null more

References

Security Update for SQL Server 2022 RTM CU15
The Security Update for SQL Server 2022 RTM CU15 is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2022 RTM CU15, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2024-37341 - Security Update Guide - Microsoft - Microsoft SQL Server Elevation of Privilege Vulnerability Security Update of SQL Server 2022 RTM CU15 KB Article: KB5046059 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=a86e15b4-deac-4108-be7f-d2f051f3a004 Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5046059 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates
Security Update for SQL Server 2022 RTM GDR
The Security Update for SQL Server 2022 RTM GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2022 RTM, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2024-37341 - Security Update Guide - Microsoft - Microsoft SQL Server Elevation of Privilege Vulnerability Security Update of SQL Server 2022 RTM GDR KB Article: KB5046057 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=e92ae40f-1f5f-4c92-992e-9f4268a50a30 Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5046057 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates
Security Update for SQL Server 2019 RTM CU28
The Security Update for SQL Server 2019 RTM CU28 is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2019 RTM CU28, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2024-37341 - Security Update Guide - Microsoft - Microsoft SQL Server Elevation of Privilege Vulnerability Security Update of SQL Server 2019 RTM CU28 KB Article: KB5046060 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?id=98e74abe-76bb-4714-a7d0-16cb1237c19c Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5046060 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates
See 8 more references

News

Peek into Monthly Vulnerabilities: October 2024
Impact : Exploiting this vulnerability can result in remote code execution, which can lead to full system compromise, data theft, or service disruption. Several key Common Vulnerabilities and Exposures (CVEs) were published during this month, which could potentially grant attackers easy access to target systems.
Amnesia Stealer
Impact : Exploiting this vulnerability can result in remote code execution, which can lead to full system compromise, data theft, or service disruption. Several key Common Vulnerabilities and Exposures (CVEs) were published during this month, which could potentially grant attackers easy access to target systems.
Vulnerability Summary for the Week of September 9, 2024
High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source Info Patch Info Siemens–Industrial Edge Management Pro A vulnerability has been identified in Industrial Edge Management Pro (All versions 2024-09-10 10 CVE-2024-45032 productcert@siemens.com SAML-Toolkits–ruby-saml The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in 2024-09-10 10 CVE-2024-45409 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com Baxter–Connex Health Portal In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex portal’s database. An attacker could have submitted a crafted payload to Connex portal that could have resulted in modification and disclosure of database content and/or perform administrative operations including shutting down the database. 2024-09-09 10 CVE-2024-6795 productsecurity@baxter.com nik00726–video carousel slider with lightbox The video carousel slider with lightbox plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2024-09-11 9.1 CVE-2019-25212 security@wordfence.com security@wordfence.com security@wordfence.com n/a–n/a Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function. 2024-09-10 9.8 CVE-2023-37226 cve@mitre.org cve@mitre.org cve@mitre.org n/a–n/a Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data. 2024-09-10 9.8 CVE-2023-37227 cve@mitre.org cve@mitre.org cve@mitre.org n/a–n/a Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password. 2024-09-10 9.8 CVE-2023-37231 cve@mitre.org cve@mitre.org cve@mitre.org Simple Online Planning–SO Planning A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, a attacker can upload a PHP-file that will be available for execution for a few milliseconds before it is removed, leading to execution of code on the underlying system.
Microsoft Patch Tuesday – October 2024
Second in line is CVE-2024-43609 with a CVSS base score of 6.5, it isn’t the most critical this month, but Microsoft has indicated it as one of the vulnerabilities that is more likely to be exploited. As always, our team has put together the monthly Patch Tuesday Report to help you manage your update progress.
Security Update for SQL Server 2022 RTM CU15
The Security Update for SQL Server 2022 RTM CU15 is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2022 RTM CU15, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2024-37341 - Security Update Guide - Microsoft - Microsoft SQL Server Elevation of Privilege Vulnerability Security Update of SQL Server 2022 RTM CU15 KB Article: KB5046059 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=a86e15b4-deac-4108-be7f-d2f051f3a004 Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5046059 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates
See 48 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI