CVE-2023-36785: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Published Oct 10, 2023
·Updated
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Affected Software
18 affected componentsFixes available
Microsoft ODBC Driver 18 for SQL Server on MacOS
Microsoft ODBC Driver 18 for SQL Server on Linux
Microsoft ODBC Driver 18 for SQL Server on Windows
Microsoft ODBC Driver 17 for SQL Server on Windows
Microsoft ODBC Driver 17 for SQL Server on Linux
Microsoft ODBC Driver 17 for SQL Server on MacOS
Microsoft SQL Server 2022 (CU 8)
Microsoft SQL Server 2019 (CU 22)
Microsoft Odbc Driver For Sql Server Linux>=17.0.1.1<17.10.5.1
Microsoft Odbc Driver For Sql Server Macos>=17.0.1.1<17.10.5.1
Microsoft Odbc Driver For Sql Server Windows>=17.0.1.1<17.10.5.1
Microsoft Odbc Driver For Sql Server Linux>=18.0.1.1<18.3.2.1
Microsoft Odbc Driver For Sql Server Macos>=18.0.1.1<18.3.2.1
Microsoft Odbc Driver For Sql Server Windows>=18.0.1.1<18.3.2.1
Microsoft SQL Server=2019-cumulative_update_22
Microsoft SQL Server=2022-cumulative_update_8
Microsoft SQL Server 2022
Microsoft SQL Server 2019
Remediation
Event History
Oct 10, 2023
CVE Published
via Microsoft·07:00 AM
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
Description
CVE Published
via MITRE·05:08 PM
Data Sourced
via MITRE·05:08 PM
DescriptionSeverity
Frequently Asked Questions
1
What is CVE-2023-36785?
CVE-2023-36785 is a vulnerability in the Microsoft ODBC Driver for SQL Server that allows remote code execution.
2
How severe is CVE-2023-36785?
CVE-2023-36785 has a severity level of 7.8, which is considered high.
3
Which software is affected by CVE-2023-36785?
The affected software includes Microsoft ODBC Driver 17/18 for SQL Server on Windows/Linux/MacOS, SQL Server 2022/2019, and ODBC Driver 18 for SQL Server on Windows.
4
How can I fix CVE-2023-36785?
To fix CVE-2023-36785, install the relevant patches or updates provided by Microsoft for the affected software.
5
Where can I find more information about CVE-2023-36785?
More information about CVE-2023-36785 can be found on the Microsoft Security Response Center website.