PT-2024-6357 · Microsoft · Sql Server

Published 2024-09-10 · Updated 2024-10-09 · CVE-2024-37341

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server versions prior to 13.0.7045.2 Microsoft SQL Server versions prior to 13.0.6450.1 Microsoft SQL Server versions prior to 15.0.4395.2 Microsoft SQL Server versions prior to 15.0.2125.1 Microsoft SQL Server versions prior to 14.0.3480.1 Microsoft SQL Server versions prior to 14.0.2065.1 Microsoft SQL Server versions prior to 16.0.4150.1 Microsoft SQL Server versions prior to 16.0.1130.5

Description The vulnerability in Microsoft SQL Server is related to inadequate access control. Exploitation of the vulnerability may allow a remote attacker to elevate their privileges.

Recommendations For versions prior to 13.0.7045.2, apply the security update for SQL Server 2016 SP3. For versions prior to 13.0.6450.1, apply the security update for SQL Server 2016 GDR. For versions prior to 15.0.4395.2, apply the security update for SQL Server 2019 CU28. For versions prior to 15.0.2125.1, apply the security update for SQL Server 2019 GDR. For versions prior to 14.0.3480.1, apply the security update for SQL Server 2017 CU31. For versions prior to 14.0.2065.1, apply the security update for SQL Server 2017 GDR. For versions prior to 16.0.4150.1, apply the security update for SQL Server 2022 CU15. For versions prior to 16.0.1130.5, apply the security update for SQL Server 2022 GDR.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2024-07395

CVE-2024-37341

Affected Products

Sql Server

References · 13

• https://bdu.fstec.ru/vul/CVE-2024-37341 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37341 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37341 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37341 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-37341 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07395 · Security Note
• https://twitter.com/SqlServerBuilds/status/1844077131338481990 · Twitter Post
• https://twitter.com/SqlServerBuilds/status/1844077216038338639 · Twitter Post
• https://t.me/cvenotify/95690 · Telegram Post
• https://twitter.com/CveFindCom/status/1833559942357196982 · Twitter Post
• https://twitter.com/SqlServerBuilds/status/1844077308564603262 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37341 · Note
• https://twitter.com/SqlServerBuilds/status/1844077374390010299 · Twitter Post