CVE-2024-37966 - Vulnerability Details

Vendors	Products
Microsoft	Sql Server 2017 Sql Server 2019 Sql Server 2022

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37966

Type	Values Removed	Values Added
First Time appeared		Microsoft Microsoft sql Server 2017 Microsoft sql Server 2019 Microsoft sql Server 2022
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:microsoft:sql_server_2017:::::::x64:* cpe:2.3:a:microsoft:sql_server_2019:::::::x64:* cpe:2.3:a:microsoft:sql_server_2022:::::::x64:*
Vendors & Products		Microsoft Microsoft sql Server 2017 Microsoft sql Server 2019 Microsoft sql Server 2022

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:microsoft:sql_server:2017:-:::::x64:* cpe:2.3:a:microsoft:sql_server:2019::::::x64: cpe:2.3:a:microsoft:sql_server:2022::::::x64:
Vendors & Products	Microsoft Microsoft sql Server

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
Title		Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
First Time appeared		Microsoft Microsoft sql Server
Weaknesses		CWE-125
CPEs		cpe:2.3:a:microsoft:sql_server:2017:-:::::x64:* cpe:2.3:a:microsoft:sql_server:2019::::::x64: cpe:2.3:a:microsoft:sql_server:2022::::::x64:
Vendors & Products		Microsoft Microsoft sql Server
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37966
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-37966", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2024-06-10T21:22:19.228Z", "datePublished": "2024-09-10T16:53:36.605Z", "dateUpdated": "2024-12-31T23:02:29.737Z"}, "containers": {"cna": {"title": "Microsoft SQL Server Native Scoring Information Disclosure Vulnerability", "datePublic": "2024-09-10T07:00:00+00:00", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*", "versionStartIncluding": "14.0.0", "versionEndExcluding": "14.0.2060.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*", "versionStartIncluding": "15.0.0", "versionEndExcluding": "15.0.2120.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*", "versionStartIncluding": "14.0.0", "versionEndExcluding": "14.0.3475.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*", "versionStartIncluding": "16.0.0", "versionEndExcluding": "16.0.1125.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*", "versionStartIncluding": "16.0.0", "versionEndExcluding": "16.0.4140.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*", "versionStartIncluding": "15.0.0", "versionEndExcluding": "15.0.4390.2"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft SQL Server 2017 (GDR)", "platforms": ["x64-based Systems"], "versions": [{"version": "14.0.0", "lessThan": "14.0.2060.1", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2019 (GDR)", "platforms": ["x64-based Systems"], "versions": [{"version": "15.0.0", "lessThan": "15.0.2120.1", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2017 (CU 31)", "platforms": ["x64-based Systems"], "versions": [{"version": "14.0.0", "lessThan": "14.0.3475.1", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2022 (GDR)", "platforms": ["x64-based Systems"], "versions": [{"version": "16.0.0", "lessThan": "16.0.1125.1", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2022 for (CU 14)", "platforms": ["x64-based Systems"], "versions": [{"version": "16.0.0", "lessThan": "16.0.4140.3", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2019 (CU 28)", "platforms": ["x64-based Systems"], "versions": [{"version": "15.0.0", "lessThan": "15.0.4390.2", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Microsoft SQL Server Native Scoring Information Disclosure Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-125: Out-of-bounds Read", "lang": "en-US", "type": "CWE", "cweId": "CWE-125"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-12-31T23:02:29.737Z"}, "references": [{"name": "Microsoft SQL Server Native Scoring Information Disclosure Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37966"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-10T19:13:14.833797Z", "id": "CVE-2024-37966", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-10T19:13:49.657Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-37966 (string)

assignerOrgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

state : PUBLISHED (string)

assignerShortName : microsoft (string)

dateReserved : 2024-06-10T21:22:19.228Z (string)

datePublished : 2024-09-10T16:53:36.605Z (string)

dateUpdated : 2024-12-31T23:02:29.737Z (string)

}

containers : { »

cna : { »

title : Microsoft SQL Server Native Scoring Information Disclosure Vulnerability (string)

datePublic : 2024-09-10T07:00:00+00:00 (string)

cpeApplicability : [ »

0 : { »

nodes : [ »

0 : { »

operator : OR (string)

negate : false (boolean)

cpeMatch : [ »

0 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:* (string)

versionStartIncluding : 14.0.0 (string)

versionEndExcluding : 14.0.2060.1 (string)

}

1 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 15.0.0 (string)

versionEndExcluding : 15.0.2120.1 (string)

}

2 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:* (string)

versionStartIncluding : 14.0.0 (string)

versionEndExcluding : 14.0.3475.1 (string)

}

3 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 16.0.0 (string)

versionEndExcluding : 16.0.1125.1 (string)

}

4 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 16.0.0 (string)

versionEndExcluding : 16.0.4140.3 (string)

}

5 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 15.0.0 (string)

versionEndExcluding : 15.0.4390.2 (string)

}

]

}

]

}

]

affected : [ »

0 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2017 (GDR) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 14.0.0 (string)

lessThan : 14.0.2060.1 (string)

versionType : custom (string)

status : affected (string)

}

]

}

1 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2019 (GDR) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 15.0.0 (string)

lessThan : 15.0.2120.1 (string)

versionType : custom (string)

status : affected (string)

}

]

}

2 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2017 (CU 31) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 14.0.0 (string)

lessThan : 14.0.3475.1 (string)

versionType : custom (string)

status : affected (string)

}

]

}

3 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2022 (GDR) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 16.0.0 (string)

lessThan : 16.0.1125.1 (string)

versionType : custom (string)

status : affected (string)

}

]

}

4 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2022 for (CU 14) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 16.0.0 (string)

lessThan : 16.0.4140.3 (string)

versionType : custom (string)

status : affected (string)

}

]

}

5 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2019 (CU 28) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 15.0.0 (string)

lessThan : 15.0.4390.2 (string)

versionType : custom (string)

status : affected (string)

}

]

}

]

descriptions : [ »

0 : { »

value : Microsoft SQL Server Native Scoring Information Disclosure Vulnerability (string)

lang : en-US (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : CWE-125: Out-of-bounds Read (string)

lang : en-US (string)

type : CWE (string)

cweId : CWE-125 (string)

}

]

}

]

providerMetadata : { »

orgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

shortName : microsoft (string)

dateUpdated : 2024-12-31T23:02:29.737Z (string)

}

references : [ »

0 : { »

name : Microsoft SQL Server Native Scoring Information Disclosure Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

]

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37966 (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en-US (string)

value : GENERAL (string)

}

]

cvssV3_1 : { »

version : 3.1 (string)

baseSeverity : HIGH (string)

baseScore : 7.1 (number)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C (string)

}

]

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-09-10T19:13:14.833797Z (string)

id : CVE-2024-37966 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-10T19:13:49.657Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-37966", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T19:13:14.833797Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-10T19:13:39.170Z"}}], "cna": {"title": "Microsoft SQL Server Native Scoring Information Disclosure Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft SQL Server 2017 (GDR)", "versions": [{"status": "affected", "version": "14.0.0", "lessThan": "14.0.2060.1", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2019 (GDR)", "versions": [{"status": "affected", "version": "15.0.0", "lessThan": "15.0.2120.1", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2017 (CU 31)", "versions": [{"status": "affected", "version": "14.0.0", "lessThan": "14.0.3475.1", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2022 (GDR)", "versions": [{"status": "affected", "version": "16.0.0", "lessThan": "16.0.1125.1", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2022 for (CU 14)", "versions": [{"status": "affected", "version": "16.0.0", "lessThan": "16.0.4140.3", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2019 (CU 28)", "versions": [{"status": "affected", "version": "15.0.0", "lessThan": "15.0.4390.2", "versionType": "custom"}], "platforms": ["x64-based Systems"]}], "datePublic": "2024-09-10T07:00:00+00:00", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37966", "name": "Microsoft SQL Server Native Scoring Information Disclosure Vulnerability", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Microsoft SQL Server Native Scoring Information Disclosure Vulnerability"}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "14.0.2060.1", "versionStartIncluding": "14.0.0"}, {"criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "15.0.2120.1", "versionStartIncluding": "15.0.0"}, {"criteria": "cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "14.0.3475.1", "versionStartIncluding": "14.0.0"}, {"criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "16.0.1125.1", "versionStartIncluding": "16.0.0"}, {"criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "16.0.4140.3", "versionStartIncluding": "16.0.0"}, {"criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "15.0.4390.2", "versionStartIncluding": "15.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-12-31T23:02:29.737Z"}}}, "cveMetadata": {"cveId": "CVE-2024-37966", "state": "PUBLISHED", "dateUpdated": "2024-12-31T23:02:29.737Z", "dateReserved": "2024-06-10T21:22:19.228Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2024-09-10T16:53:36.605Z", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-37966 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-09-10T19:13:14.833797Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-10T19:13:39.170Z (string)

}

]

cna : { »

title : Microsoft SQL Server Native Scoring Information Disclosure Vulnerability (string)

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

version : 3.1 (string)

baseScore : 7.1 (number)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C (string)

}

scenarios : [ »

0 : { »

lang : en-US (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2017 (GDR) (string)

versions : [ »

0 : { »

status : affected (string)

version : 14.0.0 (string)

lessThan : 14.0.2060.1 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

1 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2019 (GDR) (string)

versions : [ »

0 : { »

status : affected (string)

version : 15.0.0 (string)

lessThan : 15.0.2120.1 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

2 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2017 (CU 31) (string)

versions : [ »

0 : { »

status : affected (string)

version : 14.0.0 (string)

lessThan : 14.0.3475.1 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

3 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2022 (GDR) (string)

versions : [ »

0 : { »

status : affected (string)

version : 16.0.0 (string)

lessThan : 16.0.1125.1 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

4 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2022 for (CU 14) (string)

versions : [ »

0 : { »

status : affected (string)

version : 16.0.0 (string)

lessThan : 16.0.4140.3 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

5 : { »

vendor : Microsoft (string)

product : Microsoft SQL Server 2019 (CU 28) (string)

versions : [ »

0 : { »

status : affected (string)

version : 15.0.0 (string)

lessThan : 15.0.4390.2 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

]

datePublic : 2024-09-10T07:00:00+00:00 (string)

references : [ »

0 : { »

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37966 (string)

name : Microsoft SQL Server Native Scoring Information Disclosure Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

]

}

]

descriptions : [ »

0 : { »

lang : en-US (string)

value : Microsoft SQL Server Native Scoring Information Disclosure Vulnerability (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en-US (string)

type : CWE (string)

cweId : CWE-125 (string)

description : CWE-125: Out-of-bounds Read (string)

}

]

}

]

cpeApplicability : [ »

0 : { »

nodes : [ »

0 : { »

negate : false (boolean)

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 14.0.2060.1 (string)

versionStartIncluding : 14.0.0 (string)

}

1 : { »

criteria : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 15.0.2120.1 (string)

versionStartIncluding : 15.0.0 (string)

}

2 : { »

criteria : cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 14.0.3475.1 (string)

versionStartIncluding : 14.0.0 (string)

}

3 : { »

criteria : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 16.0.1125.1 (string)

versionStartIncluding : 16.0.0 (string)

}

4 : { »

criteria : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 16.0.4140.3 (string)

versionStartIncluding : 16.0.0 (string)

}

5 : { »

criteria : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 15.0.4390.2 (string)

versionStartIncluding : 15.0.0 (string)

}

]

operator : OR (string)

}

]

}

]

providerMetadata : { »

orgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

shortName : microsoft (string)

dateUpdated : 2024-12-31T23:02:29.737Z (string)

}

cveMetadata : { »

cveId : CVE-2024-37966 (string)

state : PUBLISHED (string)

dateUpdated : 2024-12-31T23:02:29.737Z (string)

dateReserved : 2024-06-10T21:22:19.228Z (string)

assignerOrgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

datePublished : 2024-09-10T16:53:36.605Z (string)

assignerShortName : microsoft (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:*", "matchCriteriaId": "092AF402-BDA3-46C2-ADB8-BEA92DF81BA5", "versionEndExcluding": "14.0.2060.1", "versionStartIncluding": "14.0.1000.169", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:*", "matchCriteriaId": "6E6AD612-AB64-4454-970E-D868420C6CC6", "versionEndExcluding": "14.0.3475.1", "versionStartIncluding": "14.0.3006.16", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*", "matchCriteriaId": "64D0E7A9-846A-421E-A3E0-E2C0CDACD13C", "versionEndExcluding": "15.0.2120.1", "versionStartIncluding": "15.0.2000.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*", "matchCriteriaId": "AF8BBB82-ED5C-4943-A787-EA07536BCFBF", "versionEndExcluding": "15.0.4390.2", "versionStartIncluding": "15.0.4003.23", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*", "matchCriteriaId": "30D1D16A-0B3E-49B4-9DB4-77FC462BA503", "versionEndExcluding": "16.0.1125.1", "versionStartIncluding": "16.0.1000.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*", "matchCriteriaId": "148D362E-101A-4121-9790-B537D02CB114", "versionEndExcluding": "16.0.4140.3", "versionStartIncluding": "16.0.4003.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Microsoft SQL Server Native Scoring Information Disclosure Vulnerability"}, {"lang": "es", "value": "Vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n de puntuaci\u00f3n nativa de Microsoft SQL Server"}], "id": "CVE-2024-37966", "lastModified": "2025-01-15T22:31:41.957", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "secure@microsoft.com", "type": "Secondary"}]}, "published": "2024-09-10T17:15:19.197", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37966"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "secure@microsoft.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:* (string)

matchCriteriaId : 092AF402-BDA3-46C2-ADB8-BEA92DF81BA5 (string)

versionEndExcluding : 14.0.2060.1 (string)

versionStartIncluding : 14.0.1000.169 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:* (string)

matchCriteriaId : 6E6AD612-AB64-4454-970E-D868420C6CC6 (string)

versionEndExcluding : 14.0.3475.1 (string)

versionStartIncluding : 14.0.3006.16 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:* (string)

matchCriteriaId : 64D0E7A9-846A-421E-A3E0-E2C0CDACD13C (string)

versionEndExcluding : 15.0.2120.1 (string)

versionStartIncluding : 15.0.2000.5 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:* (string)

matchCriteriaId : AF8BBB82-ED5C-4943-A787-EA07536BCFBF (string)

versionEndExcluding : 15.0.4390.2 (string)

versionStartIncluding : 15.0.4003.23 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:* (string)

matchCriteriaId : 30D1D16A-0B3E-49B4-9DB4-77FC462BA503 (string)

versionEndExcluding : 16.0.1125.1 (string)

versionStartIncluding : 16.0.1000.6 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:* (string)

matchCriteriaId : 148D362E-101A-4121-9790-B537D02CB114 (string)

versionEndExcluding : 16.0.4140.3 (string)

versionStartIncluding : 16.0.4003.1 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Microsoft SQL Server Native Scoring Information Disclosure Vulnerability (string)

}

1 : { »

lang : es (string)

value : Vulnerabilidad de divulgación de información de puntuación nativa de Microsoft SQL Server (string)

}

]

id : CVE-2024-37966 (string)

lastModified : 2025-01-15T22:31:41.957 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 7.1 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 4.2 (number)

source : secure@microsoft.com (string)

type : Secondary (string)

}

]

}

published : 2024-09-10T17:15:19.197 (string)

references : [ »

0 : { »

source : secure@microsoft.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37966 (string)

}

]

sourceIdentifier : secure@microsoft.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-125 (string)

}

]

source : secure@microsoft.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object