CVE-2023-21705 - OpenCVE

Microsoft SQL Server Remote Code Execution Vulnerability

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Microsoft	Sql Server

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:sql_server:2012:sp4::::::
	cpe:2.3:a:microsoft:sql_server:2014:sp3::::::
	cpe:2.3:a:microsoft:sql_server:2016:sp3:::::x64:*
	cpe:2.3:a:microsoft:sql_server:2017::::::x64:
	cpe:2.3:a:microsoft:sql_server:2019::::::x64:
	cpe:2.3:a:microsoft:sql_server:2022::::::x64:

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21705	Patch Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: microsoft

Published: 2023-02-14T19:32:43.252Z

Updated: 2024-05-29T02:05:03.667Z

Reserved: 2022-12-13T18:08:03.490Z

Link: CVE-2023-21705

JSON object: View

NVD Information

Status : Modified

Published: 2023-02-14T20:15:13.823

Modified: 2024-05-29T03:15:23.440

Link: CVE-2023-21705

JSON object: View

Redhat Information

No data.

CWE

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-21705", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2022-12-13T18:08:03.490Z", "datePublished": "2023-02-14T19:32:43.252Z", "dateUpdated": "2024-05-29T02:05:03.667Z"}, "containers": {"cna": {"title": "Microsoft SQL Server Remote Code Execution Vulnerability", "datePublic": "2023-02-14T08:00:00+00:00", "affected": [{"vendor": "Microsoft", "product": "Microsoft SQL Server 2012 Service Pack 4 (QFE)", "cpes": ["cpe:2.3:a:microsoft:sql_server:2012:sp4:*:*:*:*:*:*"], "platforms": ["32-bit Systems"], "versions": [{"version": "11.0.0", "lessThan": "11.0.7512.11", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE)", "cpes": ["cpe:2.3:a:microsoft:sql_server:2012:sp4:*:*:*:*:*:*"], "platforms": ["x64-based Systems"], "versions": [{"version": "11.0.0", "lessThan": "11.0.7512.11", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2017 (GDR)", "cpes": ["cpe:2.3:a:microsoft:sql_server:2017:-:*:*:*:*:x64:*"], "platforms": ["x64-based Systems"], "versions": [{"version": "14.0.0", "lessThan": "14.0.2047.8", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2014 Service Pack 3 (GDR)", "cpes": [" cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:*", " cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:*"], "platforms": ["x64-based Systems", "32-bit Systems"], "versions": [{"version": "12.0.0", "lessThan": "12.0.6444.4", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2014 Service Pack 3 (CU 4)", "cpes": [" cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:*", " cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:*"], "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "12.0.0", "lessThan": "12.0.6174.8", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2019 (GDR)", "cpes": ["cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:*"], "platforms": ["x64-based Systems"], "versions": [{"version": "15.0.0", "lessThan": "15.0.2101.7", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2016 Service Pack 3 (GDR)", "cpes": ["cpe:2.3:a:microsoft:sql_server:2016:sp3:*:*:*:*:x64:*"], "platforms": ["x64-based Systems"], "versions": [{"version": "13.0.0", "lessThan": "13.0.6430.49", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack", "cpes": ["cpe:2.3:a:microsoft:sql_server:2016:sp3:*:*:*:*:x64:*"], "platforms": ["x64-based Systems"], "versions": [{"version": "13.0.0", "lessThan": "13.0.7024.30", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2017 (CU 31)", "cpes": ["cpe:2.3:a:microsoft:sql_server:2017:-:*:*:*:*:x64:*"], "platforms": ["x64-based Systems"], "versions": [{"version": "14.0.0", "lessThan": "14.0.3460.9", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2022 (GDR)", "cpes": ["cpe:2.3:a:microsoft:sql_server:2022:*:*:*:*:*:x64:*"], "platforms": ["x64-based Systems"], "versions": [{"version": "16.0.0", "lessThan": "16.0.1050.5", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2019 (CU 18)", "cpes": ["cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:*"], "platforms": ["x64-based Systems"], "versions": [{"version": "15.0.0", "lessThan": "15.0.4280.7", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Microsoft SQL Server Remote Code Execution Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-321: Use of Hard-coded Cryptographic Key", "lang": "en-US", "type": "CWE", "cweId": "CWE-321"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-05-29T02:05:03.667Z"}, "references": [{"name": "Microsoft SQL Server Remote Code Execution Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21705"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}}}