« Volver al listado

CVE-2023-23375

Estado: ModificadaAlta (7.8)—

Microsoft ODBC and OLE DB Remote Code Execution Vulnerability

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microsoft — OdbcMicrosoft — OLE DB

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-23375",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-23375",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-03T19:22:09.807119Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft OLE DB Driver 18 for SQL Server",
          "versions": [
            {
              "status": "affected",
              "version": "18.0.0",
              "lessThan": "18.6.5",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Unknown"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft OLE DB Driver 19 for SQL Server",
          "versions": [
            {
              "status": "affected",
              "version": "19.0.0",
              "lessThan": "19.3.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Unknown"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft ODBC Driver 17 for SQL Server",
          "versions": [
            {
              "status": "affected",
              "version": "17.0.0.0",
              "lessThan": "17.10.3.1",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Unknown"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft ODBC Driver 18 for SQL Server",
          "versions": [
            {
              "status": "affected",
              "version": "18.0.0.0",
              "lessThan": "18.2.1.1",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Unknown"
          ]
        }
      ]
    }
  ],
  "published": "2023-04-11T21:15:17.843",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23375",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23375",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft ODBC and OLE DB Remote Code Execution Vulnerability"
    }
  ],
  "lastModified": "2026-06-17T05:36:58.470",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:odbc:*:*:*:*:*:sql_server:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EEC2F33D-4A28-48DB-9CE9-D09328F9AD83",
              "versionEndExcluding": "17.10.3.1",
              "versionStartIncluding": "17.0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:odbc:*:*:*:*:*:sql_server:*:*",
              "vulnerable": true,
              "matchCriteriaId": "082B2A88-8D5B-4CB4-B680-E67B4B3B7A20",
              "versionEndExcluding": "18.2.1.1",
              "versionStartIncluding": "18.0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:ole_db:*:*:*:*:*:sql_server:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E956B277-ACC8-4C60-9E64-C165C102EA53",
              "versionEndExcluding": "18.6.5",
              "versionStartIncluding": "18.0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:ole_db:*:*:*:*:*:sql_server:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A598DB7-3859-47A8-AE86-B42A6AE9712F",
              "versionEndExcluding": "19.3.0",
              "versionStartIncluding": "19.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}