cbcvebase.
CVE-2024-37341
published 2024-09-10

CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability

PriorityP258critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.46%
70.5th percentile
Microsoft SQL Server Elevation of Privilege Vulnerability

Affected

21 ranges
VendorProductVersion rangeFixed in
microsoftmicrosoft_sql_server_2016_service_pack_3>= 13.0.0 < 13.0.6450.113.0.6450.1
microsoftmicrosoft_sql_server_2016_service_pack_3_azure_connect_feature_pack>= 13.0.0 < 13.0.7045.213.0.7045.2
microsoftmicrosoft_sql_server_2017>= 14.0.0 < 14.0.2065.114.0.2065.1
microsoftmicrosoft_sql_server_2017>= 14.0.0 < 14.0.3480.114.0.3480.1
microsoftmicrosoft_sql_server_2019>= 15.0.0 < 15.0.2125.115.0.2125.1
microsoftmicrosoft_sql_server_2019>= 15.0.0 < 15.0.4395.215.0.4395.2
microsoftmicrosoft_sql_server_2022>= 16.0.0 < 16.0.1130.516.0.1130.5
microsoftmicrosoft_sql_server_2022_for>= 16.0.0 < 16.0.4150.116.0.4150.1
microsoftsql_2016_azure_connect_feature_pack>= 13.0.7000.253 < 13.0.7040.113.0.7040.1
microsoftsql_server_2016>= 13.0.6300.2 < 13.0.6441.113.0.6441.1
microsoftsql_server_2017>= 14.0.1000.169 < 14.0.2060.114.0.2060.1
microsoftsql_server_2017>= 14.0.3006.16 < 14.0.3475.114.0.3475.1
microsoftsql_server_2019>= 15.0.2000.5 < 15.0.2120.115.0.2120.1
microsoftsql_server_2019>= 15.0.4003.23 < 15.0.4390.215.0.4390.2
microsoftsql_server_2022>= 16.0.1000.6 < 16.0.1125.116.0.1125.1
microsoftsql_server_2022>= 16.0.4003.1 < 16.0.4140.316.0.4140.3
msrcmicrosoft_sql_server_2016_for_x64-based_systems_service_pack_3
msrcmicrosoft_sql_server_2016_for_x64-based_systems_service_pack_3_azure_connect_fea
msrcmicrosoft_sql_server_2017_for_x64-based_systems
msrcmicrosoft_sql_server_2019_for_x64-based_systems
msrcmicrosoft_sql_server_2022_for_x64-based_systems

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability affects Microsoft SQL Server and can lead to administrator privilege escalation; monitor for unexpected privilege elevation on SQL Server instances
  • Exploit status is publicly disclosed: No, exploited: No — exploitation considered less likely; prioritize patching over active threat hunting for now
  • ·Applications using OLE DB drivers must update to Microsoft OLE DB Driver 18 or 19 to be protected; SQL Server patching alone is insufficient if the application uses an older OLE DB driver
  • ·Once a SQL Server CU update is applied, reverting to the GDR update path is not possible; choose the correct update path before applying
  • ·September 2024 GDR updates introduced known functional issues in the Change Data Capture (CDC) feature; these are resolved by the October 2024 GDR updates listed in the Security Updates table

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.