CVE-2016-7253 — Microsoft SQL Server vulnerability

CWE-2644 documents4 sources
Severity
8.8HIGHNVD
EPSS
18.2%
top 4.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft SQL Server
Timeline
PublishedNov 10
Latest updateMay 14

Description

The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Server Agent Elevation of Privilege Vulnerability."

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

▶NVDmicrosoft/sql_server2012, 2014+1

🔴Vulnerability Details

2
GHSA
GHSA-v8rg-7q38-xfvp: The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore↗2022-05-14
▶
CVEList
CVE-2016-7253: The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore↗2016-11-10
▶

📋Vendor Advisories

1
Microsoft
Microsoft SQL Server Agent Elevation of Privilege Vulnerability↗2016-11-08
▶
CVE-2016-7253 — Microsoft SQL Server vulnerability | cvebase