CVE-2023-21718 Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

2023-02-1419:32:46

CWE-191

microsoft

www.cve.org

cve-2023-21718

microsoft

odbc driver

sql server

remote code execution

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.0%

JSON

CNA Affected

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2012 Service Pack 4 (QFE)",
    "cpes": [],
    "platforms": [
      "32-bit Systems"
    ],
    "versions": [
      {
        "version": "N/A",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE)",
    "cpes": [],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "N/A",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2017 (GDR)",
    "cpes": [
      "cpe:2.3:a:microsoft:sql_server:2017:-:*:*:*:*:x64:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "14.0.0",
        "lessThan": "14.0.2047.8",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2014 Service Pack 3 (GDR)",
    "cpes": [
      " cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:*",
      " cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:*"
    ],
    "platforms": [
      "x64-based Systems",
      "32-bit Systems"
    ],
    "versions": [
      {
        "version": "12.0.0",
        "lessThan": "12.0.6444.4",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2014 Service Pack 3 (CU 4)",
    "cpes": [
      " cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:*",
      " cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:*"
    ],
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "12.0.0",
        "lessThan": "12.0.6174.8",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2019 (GDR)",
    "cpes": [
      "cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "15.0.0",
        "lessThan": "15.0.2101.7",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2016 Service Pack 3 (GDR)",
    "cpes": [
      "cpe:2.3:a:microsoft:sql_server:2016:sp3:*:*:*:*:x64:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "13.0.0",
        "lessThan": "13.0.6430.49",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack",
    "cpes": [
      "cpe:2.3:a:microsoft:sql_server:2016:sp3:*:*:*:*:x64:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "13.0.0",
        "lessThan": "13.0.7024.30",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2017 (CU 31)",
    "cpes": [
      "cpe:2.3:a:microsoft:sql_server:2017:-:*:*:*:*:x64:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "14.0.0",
        "lessThan": "14.0.3460.9",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2022 (GDR)",
    "cpes": [
      "cpe:2.3:a:microsoft:sql_server:2022:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.1050.5",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2019 (CU 18)",
    "cpes": [
      "cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "15.0.0",
        "lessThan": "15.0.4280.7",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2008 R2 Service Pack 3 (QFE)",
    "cpes": [],
    "platforms": [
      "x64-based Systems",
      "32-bit Systems"
    ],
    "versions": [
      {
        "version": "N/A",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2008 Service Pack 4 (QFE)",
    "cpes": [],
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "N/A",
        "status": "affected"
      }
    ]
  }
]