CVE-2024-28945 is a remote code execution vulnerability affecting Microsoft OLE DB Driver for SQL Server, as well as SQL Server 2019 and 2022. It carries a high CVSS score of 8.8, indicating a critical risk where an unauthenticated attacker could achieve full compromise (confidentiality, integrity, availability) with low attack complexity, requiring user interaction. While there is no evidence of active exploitation, nor publicly available exploit code like Metasploit or ExploitDB modules, the vulnerability has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 18.0.2, < 18.7.0002.0CPE matchmatch criteria | cpe:2.3:a:microsoft:ole_db_driver_for_sql_server:*:*:*:*:*:*:*:* | ||
>= 19.0.0, < 19.3.0003.0CPE matchmatch criteria | cpe:2.3:a:microsoft:ole_db_driver_for_sql_server:*:*:*:*:*:*:*:* | ||
>= 15.0.2000.5, < 15.0.2110.4CPE matchmatch criteria | cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:* | ||
>= 15.0.4003.23, < 15.0.4360.2CPE matchmatch criteria | cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:* | ||
>= 16.0.1000.6, < 16.0.1115.1CPE matchmatch criteria | cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.