CVE-2023-32028 - Vulnerability Details - OpenCVE

Microsoft SQL OLE DB Remote Code Execution Vulnerability

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.01043.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft Subscribe	Ole Db Driver For Sql Server Subscribe Sql Server Subscribe

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:ole_db_driver_for_sql_server::::::::
	cpe:2.3:a:microsoft:ole_db_driver_for_sql_server::::::::
	cpe:2.3:a:microsoft:sql_server:2019::::::x64:
	cpe:2.3:a:microsoft:sql_server:2022::::::x64:

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-36315	Microsoft SQL OLE DB Remote Code Execution Vulnerability

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32028

History

Wed, 01 Jan 2025 02:15:00 +0000

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:microsoft:ole_db_driver_18_for_sql_server:-:::::::* cpe:2.3:a:microsoft:ole_db_driver_19_for_sql_server:-:::::::* cpe:2.3:a:microsoft:visual_studio:2022:::::::* cpe:2.3:a:microsoft:visual_studio_2019:::::::: cpe:2.3:a:microsoft:visual_studio_2022:17.2:::::::* cpe:2.3:a:microsoft:visual_studio_2022:17.4:::::::*
Vendors & Products	Microsoft ole Db Driver 18 For Sql Server Microsoft ole Db Driver 19 For Sql Server Microsoft visual Studio Microsoft visual Studio 2019 Microsoft visual Studio 2022

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2023-06-16T00:44:30.155Z

Updated: 2025-01-01T01:43:44.971Z

Reserved: 2023-05-01T15:34:52.132Z

Link: CVE-2023-32028

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-06-16T01:15:28.120

Modified: 2024-11-21T08:02:33.753

Link: CVE-2023-32028

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32028", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2023-05-01T15:34:52.132Z", "datePublished": "2023-06-16T00:44:30.155Z", "dateUpdated": "2025-01-01T01:43:44.971Z"}, "containers": {"cna": {"title": "Microsoft SQL OLE DB Remote Code Execution Vulnerability", "datePublic": "2023-06-15T07:00:00+00:00", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:ole_db_driver_19_for_sql_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "19.0.0", "versionEndExcluding": "19.3.0001.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:ole_db_driver_18_for_sql_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "18.0.0", "versionEndExcluding": "18.6.0006.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*", "versionStartIncluding": "16.11.0", "versionEndExcluding": "16.11.33"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.2.0", "versionEndExcluding": "17.2.23"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.4.0", "versionEndExcluding": "17.4.15"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.6.0", "versionEndExcluding": "17.6.11"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.8.0", "versionEndExcluding": "17.8.4"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft OLE DB Driver 19 for SQL Server", "platforms": ["Unknown"], "versions": [{"version": "19.0.0", "lessThan": "19.3.0001.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft OLE DB Driver 18 for SQL Server", "platforms": ["Unknown"], "versions": [{"version": "18.0.0", "lessThan": "18.6.0006.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)", "platforms": ["Unknown"], "versions": [{"version": "16.11.0", "lessThan": "16.11.33", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.2", "platforms": ["Unknown"], "versions": [{"version": "17.2.0", "lessThan": "17.2.23", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.4", "platforms": ["Unknown"], "versions": [{"version": "17.4.0", "lessThan": "17.4.15", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.6", "platforms": ["Unknown"], "versions": [{"version": "17.6.0", "lessThan": "17.6.11", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.8", "platforms": ["Unknown"], "versions": [{"version": "17.8.0", "lessThan": "17.8.4", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Microsoft SQL OLE DB Remote Code Execution Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-122: Heap-based Buffer Overflow", "lang": "en-US", "type": "CWE", "cweId": "CWE-122"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-01T01:43:44.971Z"}, "references": [{"name": "Microsoft SQL OLE DB Remote Code Execution Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32028"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:03:28.848Z"}, "title": "CVE Program Container", "references": [{"name": "Microsoft OLE DB Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32028"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:ole_db_driver_for_sql_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "14AC92FA-A1F6-4DD6-9623-A2F33F59A4F9", "versionEndExcluding": "18.6.0006.0", "versionStartIncluding": "18.0.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:ole_db_driver_for_sql_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "6ABD3821-C5EB-4253-9D5E-6A1E29709AE3", "versionEndExcluding": "19.3.0001.0", "versionStartIncluding": "19.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:*", "matchCriteriaId": "9144F644-A3D4-440C-8978-257E71204617", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:sql_server:2022:*:*:*:*:*:x64:*", "matchCriteriaId": "6CB7AD22-F27B-4807-88F1-02ED420421D5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Microsoft SQL OLE DB Remote Code Execution Vulnerability"}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n de c\u00f3digo remota de Microsoft OLE DB\n"}], "id": "CVE-2023-32028", "lastModified": "2024-11-21T08:02:33.753", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Secondary"}]}, "published": "2023-06-16T01:15:28.120", "references": [{"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32028"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32028"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "secure@microsoft.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}