Improper Access Control (CWE-284)
Microsoft SQL Server Elevation of Privilege Vulnerability. This is a network-based vulnerability with low attack complexity and requires low privileges to exploit. It does not require user interaction. The vulnerability affects multiple versions of Microsoft SQL Server, including SQL Server 2016, 2017, 2019, and 2022, as well as SQL 2016 Azure Connect Feature Pack.
The vulnerability has a high impact on confidentiality, integrity, and availability. Successful exploitation could allow an attacker to gain elevated privileges within the Microsoft SQL Server environment, potentially leading to unauthorized access to sensitive data, modification of database contents, or disruption of database services. Given the CVSS base score of 9.8, this vulnerability is considered critical and should be prioritized for patching.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. Microsoft released an official fix for this vulnerability on September 10, 2024. The following versions are affected and should be updated: - SQL 2016 Azure Connect Feature Pack: versions 13.0.7000.253 to 13.0.7040.1 (exclusive) - SQL Server 2016: versions 13.0.6300.2 to 13.0.6441.1 (exclusive) - SQL Server 2017: versions 14.0.1000.169 to 14.0.2060.1 (exclusive) and 14.0.3006.16 to 14.0.3475.1 (exclusive) - SQL Server 2019: versions 15.0.2000.5 to 15.0.2120.1 (exclusive) and 15.0.4003.23 to 15.0.4390.2 (exclusive) - SQL Server 2022: versions 16.0.1000.6 to 16.0.1125.1 (exclusive) and 16.0.4003.1 to 16.0.4140.3 (exclusive)
1. Apply the official patch released by Microsoft as soon as possible to all affected SQL Server instances. 2. Limit network access to SQL Server instances, allowing connections only from trusted sources. 3. Implement the principle of least privilege for SQL Server user accounts. 4. Monitor SQL Server logs for suspicious activities that might indicate exploitation attempts. 5. Keep SQL Server and related systems up-to-date with the latest security patches. 6. If immediate patching is not possible, consider implementing additional network segmentation or access controls to reduce the risk of exploitation.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Detection for the vulnerability has been added to Qualys (380469)
A CVSS base score of 8.8 has been assigned.
Feedly found the first article mentioning CVE-2024-37341. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-37341
EPSS Score was set to: 0.05% (Percentile: 20%)
Detection for the vulnerability has been added to Nessus (207068)
Detection for the vulnerability has been added to Nessus (207065)
A CVSS base score of 9.8 has been assigned.