CVE-2022-23276
published 2022-02-09CVE-2022-23276: SQL Server for Linux Containers Elevation of Privilege Vulnerability
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.54%
41.8th percentile
SQL Server for Linux Containers Elevation of Privilege Vulnerability
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | sql_server | — | — |
| microsoft | sql_server_2019_for_linux_containers | >= 15.0.0 < 15.0.2090.38 | 15.0.2090.38 |
| msrc | sql_server_2019_for_linux_containers | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m74m-wrhv-h6gc: SQL Server for Linux Containers Elevation of Privilege Vulnerability
ghsa_unreviewed·2022-02-10
CVE-2022-23276 [HIGH] CWE-269 GHSA-m74m-wrhv-h6gc: SQL Server for Linux Containers Elevation of Privilege Vulnerability
SQL Server for Linux Containers Elevation of Privilege Vulnerability.
Microsoft
SQL Server for Linux Containers Elevation of Privilege Vulnerability
vendor_msrc·2022-02-08·CVSS 7.8
CVE-2022-23276 [HIGH] SQL Server for Linux Containers Elevation of Privilege Vulnerability
SQL Server for Linux Containers Elevation of Privilege Vulnerability
FAQ: If I'm running SQL Server 2019 on premise, am I vulnerable to this CVE?
This vulnerability only exists in the containerized version of SQL Server 2019 for Linux. If you are running that version, Microsoft recommends applying the update.
SQL Server: SQL Server
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
Reference: https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-change-repo?view=sql-server-ver15&pivots=ld2-rhel
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-02-09
Published