CVE-2019-1068
high · 8.8Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | sql_server | 2014 |
| microsoft | sql_server | 2014 |
| microsoft | sql_server_2016 | >= 13.0.4001.0, < 13.0.4259.0 |
| microsoft | sql_server_2016 | >= 13.0.4411.0, < 13.0.4604.0 |
| microsoft | sql_server_2016 | >= 13.0.5026.0, < 13.0.5101.9 |
| microsoft | sql_server_2016 | >= 13.0.5149.0, < 13.0.5366.0 |
| microsoft | sql_server_2017 | >= 14.0.1000.169, < 14.0.2027.2 |
| microsoft | sql_server_2017 | >= 14.0.3006.16, < 14.0.3192.2 |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2019-1068