CVE-2016-7253

Опубликовано: 10 нояб. 2016

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Средний

Описание

The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Server Agent Elevation of Privilege Vulnerability."

Ссылки

http://www.securityfocus.com/bid/94056
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037250
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-136
http://www.securityfocus.com/bid/94056
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037250
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-136

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:microsoft:sql_server:2012:sp2:*:*:*:*:*:*

cpe:2.3:a:microsoft:sql_server:2012:sp3:*:*:*:*:*:*

cpe:2.3:a:microsoft:sql_server:2014:sp1:*:*:*:*:*:*

cpe:2.3:a:microsoft:sql_server:2014:sp2:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.18223

Средний

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

CVE-2016-7253

msrc

около 5 лет назад

Microsoft SQL Server Agent Elevation of Privilege Vulnerability

GHSA-v8rg-7q38-xfvp