CVE-2002-1145: Critical severity microsoft sql server vulnerability
The xprunwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and Microsoft Desktop Engine (MSDE) 2000 can be executed by PUBLIC, which allows an attacker to gain privileges by updating a webtask that is owned by the database owner through the msdb.dbo.mswebtasks table, which does not have strong permissions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2002-1145?
CVE-2002-1145 is classified as a high-severity vulnerability due to its potential to allow unauthorized access to sensitive database operations.
How does CVE-2002-1145 impact Microsoft SQL Server?
CVE-2002-1145 allows any user to execute the xp_runwebtask stored procedure, which can compromise the security of the SQL Server instance.
How do I fix CVE-2002-1145?
To fix CVE-2002-1145, it is recommended to restrict execution permissions of the xp_runwebtask stored procedure to authorized users only.
Which versions of Microsoft SQL Server are affected by CVE-2002-1145?
CVE-2002-1145 affects Microsoft SQL Server 7.0 and 2000, including all service packs released until that time.
What are the consequences of an exploit using CVE-2002-1145?
Exploiting CVE-2002-1145 can lead to privilege escalation, allowing attackers to perform administrative tasks on the SQL Server environment.