CVE-2024-49008 - Vulnerability Details

Vendors	Products
Microsoft	Sql Server 2016 Sql Server 2017 Sql Server 2019

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49008

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:microsoft:sql_server:2016:sp3:::::x64:* cpe:2.3:a:microsoft:sql_server:2017:-:::::x64:* cpe:2.3:a:microsoft:sql_server:2019::::::x64:
Vendors & Products	Microsoft sql Server

Type	Values Removed	Values Added
First Time appeared		Microsoft sql Server 2016 Microsoft sql Server 2017 Microsoft sql Server 2019
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:microsoft:sql_server_2016:::::::x64:* cpe:2.3:a:microsoft:sql_server_2017:::::::x64:* cpe:2.3:a:microsoft:sql_server_2019:::::::x64:*
Vendors & Products		Microsoft sql Server 2016 Microsoft sql Server 2017 Microsoft sql Server 2019

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		SQL Server Native Client Remote Code Execution Vulnerability
Title		SQL Server Native Client Remote Code Execution Vulnerability
First Time appeared		Microsoft Microsoft sql Server
Weaknesses		CWE-122
CPEs		cpe:2.3:a:microsoft:sql_server:2016:sp3:::::x64:* cpe:2.3:a:microsoft:sql_server:2017:-:::::x64:* cpe:2.3:a:microsoft:sql_server:2019::::::x64:
Vendors & Products		Microsoft Microsoft sql Server
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49008
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-49008", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2024-10-11T20:57:49.179Z", "datePublished": "2024-11-12T17:54:13.676Z", "dateUpdated": "2025-01-30T00:10:18.439Z"}, "containers": {"cna": {"title": "SQL Server Native Client Remote Code Execution Vulnerability", "datePublic": "2024-11-12T08:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*", "versionStartIncluding": "14.0.0", "versionEndExcluding": "14.0.2070.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*", "versionStartIncluding": "15.0.0", "versionEndExcluding": "15.0.2130.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:*", "versionStartIncluding": "13.0.0", "versionEndExcluding": "13.0.6455.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:*", "versionStartIncluding": "13.0.0", "versionEndExcluding": "13.0.7050.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*", "versionStartIncluding": "14.0.0", "versionEndExcluding": "14.0.3485.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*", "versionStartIncluding": "15.0.0", "versionEndExcluding": "15.0.4410.1"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft SQL Server 2017 (GDR)", "platforms": ["x64-based Systems"], "versions": [{"version": "14.0.0", "lessThan": "14.0.2070.1", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2019 (GDR)", "platforms": ["x64-based Systems"], "versions": [{"version": "15.0.0", "lessThan": "15.0.2130.3", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2016 Service Pack 3 (GDR)", "platforms": ["x64-based Systems"], "versions": [{"version": "13.0.0", "lessThan": "13.0.6455.2", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack", "platforms": ["x64-based Systems"], "versions": [{"version": "13.0.0", "lessThan": "13.0.7050.2", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2017 (CU 31)", "platforms": ["x64-based Systems"], "versions": [{"version": "14.0.0", "lessThan": "14.0.3485.1", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2019 (CU 29)", "platforms": ["Unknown"], "versions": [{"version": "15.0.0", "lessThan": "15.0.4410.1", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "SQL Server Native Client Remote Code Execution Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-122: Heap-based Buffer Overflow", "lang": "en-US", "type": "CWE", "cweId": "CWE-122"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-30T00:10:18.439Z"}, "references": [{"name": "SQL Server Native Client Remote Code Execution Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49008"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-49008", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-13T17:28:43.125108Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-13T17:29:54.536Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-49008 (string)

assignerOrgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

state : PUBLISHED (string)

assignerShortName : microsoft (string)

dateReserved : 2024-10-11T20:57:49.179Z (string)

datePublished : 2024-11-12T17:54:13.676Z (string)

dateUpdated : 2025-01-30T00:10:18.439Z (string)

}

containers : { »

cna : { »

title : SQL Server Native Client Remote Code Execution Vulnerability (string)

datePublic : 2024-11-12T08:00:00.000Z (string)

cpeApplicability : [ »

0 : { »

nodes : [ »

0 : { »

operator : OR (string)

negate : false (boolean)

cpeMatch : [ »

0 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:* (string)

versionStartIncluding : 14.0.0 (string)

versionEndExcluding : 14.0.2070.1 (string)

}

1 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 15.0.0 (string)

versionEndExcluding : 15.0.2130.3 (string)

}

2 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:* (string)

versionStartIncluding : 13.0.0 (string)

versionEndExcluding : 13.0.6455.2 (string)

}

3 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:* (string)

versionStartIncluding : 13.0.0 (string)

versionEndExcluding : 13.0.7050.2 (string)

}

4 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:* (string)

versionStartIncluding : 14.0.0 (string)

versionEndExcluding : 14.0.3485.1 (string)

}

5 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 15.0.0 (string)

versionEndExcluding : 15.0.4410.1 (string)

}

]

}

]

}

]

affected : [ »

0 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2017 (GDR) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 14.0.0 (string)

lessThan : 14.0.2070.1 (string)

versionType : custom (string)

status : affected (string)

}

]

}

1 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2019 (GDR) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 15.0.0 (string)

lessThan : 15.0.2130.3 (string)

versionType : custom (string)

status : affected (string)

}

]

}

2 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2016 Service Pack 3 (GDR) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 13.0.0 (string)

lessThan : 13.0.6455.2 (string)

versionType : custom (string)

status : affected (string)

}

]

}

3 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 13.0.0 (string)

lessThan : 13.0.7050.2 (string)

versionType : custom (string)

status : affected (string)

}

]

}

4 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2017 (CU 31) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 14.0.0 (string)

lessThan : 14.0.3485.1 (string)

versionType : custom (string)

status : affected (string)

}

]

}

5 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2019 (CU 29) (string)

platforms : [ »

0 : Unknown (string)

]

versions : [ »

0 : { »

version : 15.0.0 (string)

lessThan : 15.0.4410.1 (string)

versionType : custom (string)

status : affected (string)

}

]

}

]

descriptions : [ »

0 : { »

value : SQL Server Native Client Remote Code Execution Vulnerability (string)

lang : en-US (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : CWE-122: Heap-based Buffer Overflow (string)

lang : en-US (string)

type : CWE (string)

cweId : CWE-122 (string)

}

]

}

]

providerMetadata : { »

orgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

shortName : microsoft (string)

dateUpdated : 2025-01-30T00:10:18.439Z (string)

}

references : [ »

0 : { »

name : SQL Server Native Client Remote Code Execution Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

]

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49008 (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en-US (string)

value : GENERAL (string)

}

]

cvssV3_1 : { »

version : 3.1 (string)

baseSeverity : HIGH (string)

baseScore : 8.8 (number)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C (string)

}

]

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-49008 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-11-13T17:28:43.125108Z (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-13T17:29:54.536Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-49008", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-13T17:28:43.125108Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-13T17:29:18.811Z"}}], "cna": {"title": "SQL Server Native Client Remote Code Execution Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft SQL Server 2017 (GDR)", "versions": [{"status": "affected", "version": "14.0.0", "lessThan": "14.0.2070.1", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2019 (GDR)", "versions": [{"status": "affected", "version": "15.0.0", "lessThan": "15.0.2130.3", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2016 Service Pack 3 (GDR)", "versions": [{"status": "affected", "version": "13.0.0", "lessThan": "13.0.6455.2", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack", "versions": [{"status": "affected", "version": "13.0.0", "lessThan": "13.0.7050.2", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2017 (CU 31)", "versions": [{"status": "affected", "version": "14.0.0", "lessThan": "14.0.3485.1", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2019 (CU 29)", "versions": [{"status": "affected", "version": "15.0.0", "lessThan": "15.0.4410.1", "versionType": "custom"}], "platforms": ["Unknown"]}], "datePublic": "2024-11-12T08:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49008", "name": "SQL Server Native Client Remote Code Execution Vulnerability", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "SQL Server Native Client Remote Code Execution Vulnerability"}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "14.0.2070.1", "versionStartIncluding": "14.0.0"}, {"criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "15.0.2130.3", "versionStartIncluding": "15.0.0"}, {"criteria": "cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "13.0.6455.2", "versionStartIncluding": "13.0.0"}, {"criteria": "cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "13.0.7050.2", "versionStartIncluding": "13.0.0"}, {"criteria": "cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "14.0.3485.1", "versionStartIncluding": "14.0.0"}, {"criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "15.0.4410.1", "versionStartIncluding": "15.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-30T00:10:18.439Z"}}}, "cveMetadata": {"cveId": "CVE-2024-49008", "state": "PUBLISHED", "dateUpdated": "2025-01-30T00:10:18.439Z", "dateReserved": "2024-10-11T20:57:49.179Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2024-11-12T17:54:13.676Z", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-49008 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-11-13T17:28:43.125108Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-13T17:29:18.811Z (string)

}

]

cna : { »

title : SQL Server Native Client Remote Code Execution Vulnerability (string)

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

version : 3.1 (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C (string)

}

scenarios : [ »

0 : { »

lang : en-US (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2017 (GDR) (string)

versions : [ »

0 : { »

status : affected (string)

version : 14.0.0 (string)

lessThan : 14.0.2070.1 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

1 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2019 (GDR) (string)

versions : [ »

0 : { »

status : affected (string)

version : 15.0.0 (string)

lessThan : 15.0.2130.3 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

2 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2016 Service Pack 3 (GDR) (string)

versions : [ »

0 : { »

status : affected (string)

version : 13.0.0 (string)

lessThan : 13.0.6455.2 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

3 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack (string)

versions : [ »

0 : { »

status : affected (string)

version : 13.0.0 (string)

lessThan : 13.0.7050.2 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

4 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2017 (CU 31) (string)

versions : [ »

0 : { »

status : affected (string)

version : 14.0.0 (string)

lessThan : 14.0.3485.1 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

5 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2019 (CU 29) (string)

versions : [ »

0 : { »

status : affected (string)

version : 15.0.0 (string)

lessThan : 15.0.4410.1 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : Unknown (string)

]

}

]

datePublic : 2024-11-12T08:00:00.000Z (string)

references : [ »

0 : { »

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49008 (string)

name : SQL Server Native Client Remote Code Execution Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

]

}

]

descriptions : [ »

0 : { »

lang : en-US (string)

value : SQL Server Native Client Remote Code Execution Vulnerability (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en-US (string)

type : CWE (string)

cweId : CWE-122 (string)

description : CWE-122: Heap-based Buffer Overflow (string)

}

]

}

]

cpeApplicability : [ »

0 : { »

nodes : [ »

0 : { »

negate : false (boolean)

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 14.0.2070.1 (string)

versionStartIncluding : 14.0.0 (string)

}

1 : { »

criteria : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 15.0.2130.3 (string)

versionStartIncluding : 15.0.0 (string)

}

2 : { »

criteria : cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 13.0.6455.2 (string)

versionStartIncluding : 13.0.0 (string)

}

3 : { »

criteria : cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 13.0.7050.2 (string)

versionStartIncluding : 13.0.0 (string)

}

4 : { »

criteria : cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 14.0.3485.1 (string)

versionStartIncluding : 14.0.0 (string)

}

5 : { »

criteria : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 15.0.4410.1 (string)

versionStartIncluding : 15.0.0 (string)

}

]

operator : OR (string)

}

]

}

]

providerMetadata : { »

orgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

shortName : microsoft (string)

dateUpdated : 2025-01-30T00:10:18.439Z (string)

}

cveMetadata : { »

cveId : CVE-2024-49008 (string)

state : PUBLISHED (string)

dateUpdated : 2025-01-30T00:10:18.439Z (string)

dateReserved : 2024-10-11T20:57:49.179Z (string)

assignerOrgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

datePublished : 2024-11-12T17:54:13.676Z (string)

assignerShortName : microsoft (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:x64:*", "matchCriteriaId": "94F7D410-C105-4D0E-91BC-57A36A7C30C5", "versionEndExcluding": "13.0.6455.2", "versionStartIncluding": "13.0.6300.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:x64:*", "matchCriteriaId": "DBBCB15E-0D31-44C4-AB3F-6CF06A654A02", "versionEndExcluding": "13.0.7050.2", "versionStartIncluding": "13.0.7000.253", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:*", "matchCriteriaId": "9BF43A68-2ADF-49E5-BD43-F5286AB3B93D", "versionEndExcluding": "14.0.2070.1", "versionStartIncluding": "14.0.1000.169", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:*", "matchCriteriaId": "1C6809A5-466A-41B0-9AF2-B23B1A424CA0", "versionEndExcluding": "14.0.3485.1", "versionStartIncluding": "14.0.3006.16", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*", "matchCriteriaId": "E8E62074-2024-4A7D-B8DE-B93D5B4594E4", "versionEndExcluding": "15.0.2130.3", "versionStartIncluding": "15.0.2000.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*", "matchCriteriaId": "6837EEFD-F447-4679-A001-C7BA0D11C5BA", "versionEndExcluding": "15.0.4410.1", "versionStartIncluding": "15.0.4003.23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQL Server Native Client Remote Code Execution Vulnerability"}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en SQL Server Native Client"}], "id": "CVE-2024-49008", "lastModified": "2024-11-15T16:02:22.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Primary"}]}, "published": "2024-11-12T18:15:39.423", "references": [{"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49008"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-122"}], "source": "secure@microsoft.com", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:x64:* (string)

matchCriteriaId : 94F7D410-C105-4D0E-91BC-57A36A7C30C5 (string)

versionEndExcluding : 13.0.6455.2 (string)

versionStartIncluding : 13.0.6300.2 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:x64:* (string)

matchCriteriaId : DBBCB15E-0D31-44C4-AB3F-6CF06A654A02 (string)

versionEndExcluding : 13.0.7050.2 (string)

versionStartIncluding : 13.0.7000.253 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:* (string)

matchCriteriaId : 9BF43A68-2ADF-49E5-BD43-F5286AB3B93D (string)

versionEndExcluding : 14.0.2070.1 (string)

versionStartIncluding : 14.0.1000.169 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:* (string)

matchCriteriaId : 1C6809A5-466A-41B0-9AF2-B23B1A424CA0 (string)

versionEndExcluding : 14.0.3485.1 (string)

versionStartIncluding : 14.0.3006.16 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:* (string)

matchCriteriaId : E8E62074-2024-4A7D-B8DE-B93D5B4594E4 (string)

versionEndExcluding : 15.0.2130.3 (string)

versionStartIncluding : 15.0.2000.5 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:* (string)

matchCriteriaId : 6837EEFD-F447-4679-A001-C7BA0D11C5BA (string)

versionEndExcluding : 15.0.4410.1 (string)

versionStartIncluding : 15.0.4003.23 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : SQL Server Native Client Remote Code Execution Vulnerability (string)

}

1 : { »

lang : es (string)

value : Vulnerabilidad de ejecución remota de código en SQL Server Native Client (string)

}

]

id : CVE-2024-49008 (string)

lastModified : 2024-11-15T16:02:22.743 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.9 (number)

source : secure@microsoft.com (string)

type : Primary (string)

}

]

}

published : 2024-11-12T18:15:39.423 (string)

references : [ »

0 : { »

source : secure@microsoft.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49008 (string)

}

]

sourceIdentifier : secure@microsoft.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-122 (string)

}

]

source : secure@microsoft.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object