QID 92001

QID 92001: Microsoft SQL Server Remote Code Execution (RCE) Vulnerability for April 2023

Microsoft SQL Server prone to Remote Code Execution Vulnerability. Affected Software:
SQL Server 2022 RTM (GDR)
SQL Server 2019 RTM (GDR,CU18)
SQL Server 2017 RTM (GDR,CU31)
SQL Server 2016 Service Pack 3(GDR)
SQL Server 2014 Service Pack 3 (GDR, CU4)
SQL Server 2012 SP4 (GDR)
SQL Server SQL2008R2 SP3 (GDR)
SQL Server 2008 SP4 (GDR)
QID Detection Logic (Authenticated):
Detection looks for Microsoft SQL Server instances and checks sqlservr.exe file version

Successful exploitation could lead to remote code execution

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as High - 6 severity.

Solution

Customers are advised to refer to KB5021522 KB5021523 KB5021124 KB5021125 KB5021126 KB5021127 KB5021128 KB5021129 KB5021045 KB5021037 KB5021112 KB5020863 for more details pertaining to this vulnerability.

Vendor References

CVE-2023-23384 - msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23384

CVEs related to QID 92001

CVE-2023-23384 |

Software Advisories

Advisory ID	Software	Component	Link
KB5020863			support.microsoft.com/help/5020863
KB5021037			support.microsoft.com/help/5021037
KB5021045			support.microsoft.com/help/5021045
KB5021112			support.microsoft.com/help/5021112
KB5021122			support.microsoft.com/help/5021522
KB5021123			support.microsoft.com/help/5021523
KB5021124			support.microsoft.com/help/5021524
KB5021125			support.microsoft.com/help/5021525
KB5021126			support.microsoft.com/help/5021526
KB5021127			support.microsoft.com/help/5021527
KB5021128			support.microsoft.com/help/5021528
KB5021129			support.microsoft.com/help/5021529

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].