Main Vulnerability Database Vulnerabilities #VU74928

Input validation error in Microsoft ODBC Driver for SQL Server on Windows and OLE DB Driver - CVE-2023-28304

Published: April 11, 2023

Vulnerability identifier: #VU74928

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-28304

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft ODBC and OLE DB. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Affected software

Microsoft ODBC Driver for SQL Server on Windows
OLE DB Driver

How to mitigate CVE-2023-28304

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-28304

Related Security Bulletins