« Volver al listado

CVE-2023-21704

Estado: ModificadaAlta (7.8)—

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microsoft — SQL Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-21704",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft SQL Server 2014 Service Pack 3 (CU 4)",
          "versions": [
            {
              "status": "affected",
              "version": "12.0.0",
              "lessThan": "12.0.6174.8",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft SQL Server 2014 Service Pack 3 (GDR)",
          "versions": [
            {
              "status": "affected",
              "version": "12.0.0",
              "lessThan": "12.0.6444.4",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft SQL Server 2016 Service Pack 3 (GDR)",
          "versions": [
            {
              "status": "affected",
              "version": "13.0.0",
              "lessThan": "13.0.6430.49",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack",
          "versions": [
            {
              "status": "affected",
              "version": "13.0.0",
              "lessThan": "13.0.7024.30",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft SQL Server 2017 (CU 31)",
          "versions": [
            {
              "status": "affected",
              "version": "14.0.0",
              "lessThan": "14.0.3460.9",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft SQL Server 2017 (GDR)",
          "versions": [
            {
              "status": "affected",
              "version": "14.0.0",
              "lessThan": "14.0.2047.8",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft SQL Server 2019 (CU 18)",
          "versions": [
            {
              "status": "affected",
              "version": "15.0.0",
              "lessThan": "15.0.4280.7",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft SQL Server 2019 (GDR)",
          "versions": [
            {
              "status": "affected",
              "version": "15.0.0",
              "lessThan": "15.0.2101.7",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft SQL Server 2022 (GDR)",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.0",
              "lessThan": "16.0.1050.5",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        }
      ]
    }
  ],
  "published": "2023-02-14T20:15:13.753",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21704",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21704",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability"
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecución de código remota de Microsoft ODBC Driver para SQL Server"
    }
  ],
  "lastModified": "2026-08-19T17:18:11.240",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03C65D96-44D0-4411-8B84-961973F1E4D0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2016:sp3:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "39A3D29F-0BE0-4F78-9970-58BB355775DE"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2017:*:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "2FF9FC32-3E6E-4256-B6BD-C4EF1932CA18"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "9144F644-A3D4-440C-8978-257E71204617"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2022:*:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "6CB7AD22-F27B-4807-88F1-02ED420421D5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}