« Volver al listado

CVE-2016-7250

Estado: ModificadaAlta (8.8)—

Microsoft SQL Server 2014 SP1, 2014 SP2, and 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microsoft — SQL Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-7250",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": true,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-11-10T07:00:04.130",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/94060",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1037250",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-136",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/94060",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1037250",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-136",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft SQL Server 2014 SP1, 2014 SP2, and 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka \"SQL RDBMS Engine Elevation of Privilege Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Microsoft SQL Server 2014 SP1, 2014 SP2 y 2016 no realiza correctamente el molde de un puntero no especificado, lo que permite a usuarios remotos autenticados obtener privilegios a través de vectores desconocidos, vulnerabilidad también conocida como \"SQL RDBMS Engine Elevation of Privilege Vulnerability\"."
    }
  ],
  "lastModified": "2026-06-17T00:52:51.693",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2014:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5A0AA01-39E8-42A5-8B57-46BEE3A2CD51"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2014:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58837806-386A-40AC-B8D3-35765113D75C"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2016:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40058AB9-EE59-449E-B4C4-541E12A4861F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}