« Volver al listado

CVE-2023-36417

Estado: ModificadaAlta (7.8)—

Microsoft SQL OLE DB Remote Code Execution Vulnerability

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microsoft — OLE DB Driver FOR SQL ServerMicrosoft — SQL Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-36417",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-36417",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-26T21:49:50.389321Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft SQL Server 2019 (GDR)",
          "versions": [
            {
              "status": "affected",
              "version": "15.0.0",
              "lessThan": "15.0.2104.1",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft SQL Server 2022 (GDR)",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.0",
              "lessThan": "16.0.1105.1",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft OLE DB Driver 19 for SQL Server",
          "versions": [
            {
              "status": "affected",
              "version": "19.0.0",
              "lessThan": "19.3.0002.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Unknown"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft OLE DB Driver 18 for SQL Server",
          "versions": [
            {
              "status": "affected",
              "version": "18.0.0",
              "lessThan": "18.6.0007.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Unknown"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft SQL Server 2022 (CU 8)",
          "versions": [
            {
              "status": "affected",
              "version": "15.0.0",
              "lessThan": "16.0.4080.1",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft SQL Server 2019 (CU 22)",
          "versions": [
            {
              "status": "affected",
              "version": "15.0.0",
              "lessThan": "15.0.4326.1",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        }
      ]
    }
  ],
  "published": "2023-10-10T18:15:12.190",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36417",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36417",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft SQL OLE DB Remote Code Execution Vulnerability"
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecución remota de código de Microsoft SQL OLE DB"
    }
  ],
  "lastModified": "2026-06-17T06:06:14.677",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:ole_db_driver_for_sql_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0867B7A-05C8-40C7-B136-D05042AEE5F3",
              "versionEndExcluding": "18.6.0007.0",
              "versionStartIncluding": "18.0.0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:ole_db_driver_for_sql_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16A5EBE4-0A7A-4D69-A01F-0A7BB84A454E",
              "versionEndExcluding": "19.3.0002.0",
              "versionStartIncluding": "19.0.0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "9144F644-A3D4-440C-8978-257E71204617"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2022:*:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "6CB7AD22-F27B-4807-88F1-02ED420421D5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}