CVE-2015-1761 is an elevation of privilege vulnerability affecting multiple versions of Microsoft SQL Server (2008 SP3/SP4, 2008 R2 SP2/SP3, 2012 SP1/SP2, and 2014). It stems from the server using an incorrect class during unspecified pointer casts, allowing remote authenticated users with certain write access to gain elevated privileges. The vulnerability has a CVSS score of 6.5 (medium severity), indicating it can be exploited remotely with low attack complexity by an authenticated user, potentially leading to partial confidentiality, integrity, and availability impacts. While the EPSS score is low, suggesting a low likelihood of exploitation, there is no public exploit intelligence available, nor any recorded community discussion or media coverage, indicating it is not actively exploited or widely discussed.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2008CPE matchmatch criteria | cpe:2.3:a:microsoft:sql_server:2008:r2_sp2:*:*:*:*:*:* | ||
2008CPE matchmatch criteria | cpe:2.3:a:microsoft:sql_server:2008:r2_sp3:*:*:*:*:*:* | ||
2008CPE matchmatch criteria | cpe:2.3:a:microsoft:sql_server:2008:sp3:*:*:*:*:*:* | ||
2008CPE matchmatch criteria | cpe:2.3:a:microsoft:sql_server:2008:sp4:*:*:*:*:*:* | ||
2012CPE matchmatch criteria | cpe:2.3:a:microsoft:sql_server:2012:sp1:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:S/C:P/I:P/A:P
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.