CVE-2024-37966
Out-of-bounds Read (CWE-125)
Summary
Microsoft SQL Server Native Scoring has an information disclosure vulnerability. This is related to an out-of-bounds read issue, which could potentially lead to unauthorized access to sensitive information.
Impact
This vulnerability allows network-based attacks with low attack complexity. It primarily affects the confidentiality of the system, with a high impact on data confidentiality. There is also a low impact on system availability. The attack requires low privileges and no user interaction. The overall base score for this vulnerability is 7.1 out of 10, indicating it's a high severity issue.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft released an update to address this vulnerability on September 10, 2024.
Mitigation
1. Apply the security update provided by Microsoft as soon as possible. 2. Implement network segmentation to limit exposure of SQL Server instances. 3. Ensure that SQL Server instances are not directly exposed to untrusted networks. 4. Apply the principle of least privilege for SQL Server access. 5. Monitor SQL Server logs for any suspicious activities. 6. Keep all SQL Server installations up to date with the latest security patches.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C
Timeline
Detection for the vulnerability has been added to Qualys (380469)
A CVSS base score of 7.1 has been assigned.
Feedly found the first article mentioning CVE-2024-37966. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-37966
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.05% (Percentile: 18.8%)
Detection for the vulnerability has been added to Nessus (207067)
Detection for the vulnerability has been added to Nessus (207069)