CVE-2024-0056

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-0056
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

8.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056 Patch Vendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:microsoft:microsoft.data.sqlclient:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft.data.sqlclient:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft.data.sqlclient:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft.data.sqlclient:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2022:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sql_server:2022:cumulative_update_10:*:*:*:*:*:*
cpe:2.3:a:microsoft:system.data.sqlclient:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*
OR cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

Configuration 4 (hide)

AND
OR cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
OR cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
OR cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*
OR cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022_23h2:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
OR cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
OR cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022_23h2:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
OR cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
OR cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*

Configuration 9 (hide)

OR cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:8.0.0:-:*:*:*:*:*:*
History

21 Nov 2024, 08:45

Type Values Removed Values Added
References () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056 - Patch, Vendor Advisory () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056 - Patch, Vendor Advisory

29 May 2024, 00:15

Type Values Removed Values Added
CWE CWE-319

28 May 2024, 21:16

Type Values Removed Values Added
CWE CWE-319

16 Jan 2024, 18:42

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:arm64:*
cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft.data.sqlclient:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:*
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2022_23h2:-:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2022:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2022:cumulative_update_10:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:8.0.0:-:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:system.data.sqlclient:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
First Time Microsoft windows 10 1607
Microsoft windows Server 2022
Microsoft visual Studio 2022
Microsoft sql Server
Microsoft windows Server 2008
Microsoft windows Server 2019
Microsoft system.data.sqlclient
Microsoft windows 11 23h2
Microsoft
Microsoft windows Server 2016
Microsoft windows Server 2012
Microsoft windows 10 22h2
Microsoft windows 10 1809
Microsoft windows 10 21h2
Microsoft windows Server 2022 23h2
Microsoft .net
Microsoft microsoft.data.sqlclient
Microsoft .net Framework
Microsoft windows 11 21h2
Microsoft windows 11 22h2
References () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056 - () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056 - Patch, Vendor Advisory

09 Jan 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-09 18:15

Updated : 2024-11-21 08:45

NVD link : CVE-2024-0056

Mitre link : CVE-2024-0056

CVE.ORG link : CVE-2024-0056

JSON object : View

Products Affected

microsoft

  • .net_framework
  • windows_10_22h2
  • windows_10_21h2
  • windows_11_21h2
  • system.data.sqlclient
  • windows_server_2016
  • windows_11_22h2
  • windows_server_2008
  • .net
  • windows_10_1607
  • microsoft.data.sqlclient
  • sql_server
  • windows_server_2012
  • visual_studio_2022
  • windows_server_2022
  • windows_server_2019
  • windows_11_23h2
  • windows_10_1809
  • windows_server_2022_23h2
CWE
CWE-319

Cleartext Transmission of Sensitive Information

NVD-CWE-noinfo