Sep 2024: Microsoft SQL Server Information Disclosure Vulnerability
CVE-2024-43474 Published on September 10, 2024
Microsoft SQL Server Information Disclosure Vulnerability
Microsoft SQL Server Information Disclosure Vulnerability
Vulnerability Analysis
Weakness Type
Improper Null Termination
The software does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator. Null termination errors frequently occur in two different ways. An off-by-one error could cause a null to be written out of bounds, leading to an overflow. Or, a program could use a strncpy() function call incorrectly, which prevents a null terminator from being added at all. Other scenarios are possible.
Products Associated with CVE-2024-43474
Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.
Affected Versions
Microsoft SQL Server 2017 (CU 31):- Version 14.0.0 and below 14.0.3475.1 is affected.
- Version 14.0.0 and below 14.0.2060.1 is affected.
- Version 15.0.0 and below 15.0.2120.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.