Vulnerability/
CVE-2024-0056

CVE-2024-0056: Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Published Dec 20, 2023

·

Updated

Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) - client library supports establishing non-ssl TCP connection

Other sources

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

— Microsoft

Affected Software

116 affected componentsFixes available

Microsoft .NET 8.0

Patch available

Microsoft .NET 6.0

Patch available

Microsoft .NET 7.0

Patch available

nuget/Microsoft.Data.SqlClient>=5.0.0<5.1.3

5.1.3

nuget/Microsoft.Data.SqlClient>=4.0.0<4.0.5

4.0.5

nuget/Microsoft.Data.SqlClient>=3.0.0<3.1.5

3.1.5

nuget/System.Data.SqlClient<4.8.6

4.8.6

nuget/Microsoft.Data.SqlClient<2.1.7

2.1.7

Microsoft SQL Server 2022 (CU 10)

Patch available

Microsoft SQL Server 2022 (CU 10)

Patch available

Microsoft Microsoft.Data.SqlClient 5.1

Patch available

Microsoft System.Data.SqlClient

Patch available

Microsoft Microsoft.Data.SqlClient 3.1

Patch available

Microsoft Microsoft.Data.SqlClient 4.0

Patch available

Microsoft Microsoft.Data.SqlClient 2.1

Patch available

Microsoft SQL Server 2022

Patch available

Microsoft .NET Framework=2.0

Patch available Patch available

Microsoft .NET Framework=4.6.2, =4.7, =4.7.1, =4.7.2

Patch available

Microsoft .NET Framework=4.8

Patch available Patch available

Microsoft .NET Framework=4.6.2, =4.7, =4.7.1, =4.7.2

Patch available

Microsoft .NET Framework=4.8

Patch available

Microsoft .NET Framework=4.8

Patch available

Microsoft .NET Framework=4.6.2, =4.7, =4.7.1, =4.7.2

Patch available

Microsoft .NET Framework=3.5, =4.7.2

Patch available

Microsoft .NET Framework=4.8

Patch available

Microsoft .NET Framework=3.5, =4.8

Patch available

Microsoft .NET Framework=3.5, =4.7.2

Patch available

Microsoft .NET Framework=3.5, =4.8

Patch available

Microsoft .NET Framework=3.5, =4.8.1

Patch available

Microsoft .NET Framework=3.5, =4.8

Patch available

Microsoft .NET Framework=3.5, =4.8.1

Patch available

Microsoft .NET Framework=3.5, =4.8.1

Patch available

Microsoft .NET Framework=3.5, =4.8

Patch available

Microsoft .NET Framework=3.5, =4.8.1

Patch available

Microsoft .NET Framework=3.5, =4.8.1

Patch available

redhat/.NET SDK 6.0.126 and .NET Runtime 6.0.26 and .NET SDK 7.0.115 and .NET Runtime<7.0.15

7.0.15

Microsoft Visual Studio 2022=17.2

Patch available

Microsoft Visual Studio 2022=17.4

Patch available

Microsoft Visual Studio 2022=17.8

Patch available

Microsoft Microsoft.Data.SqlClient>=2.1<2.1.7

Microsoft Microsoft.Data.SqlClient>=3.1<3.1.5

Microsoft Microsoft.Data.SqlClient>=4.0<4.0.5

Microsoft Microsoft.Data.SqlClient>=5.1<5.1.3

Microsoft SQL Server=2022

Microsoft SQL Server=2022-cumulative_update_10

Microsoft System.Data.SqlClient<4.8.6

Microsoft Visual Studio 2022>=17.2<17.2.23

Microsoft Visual Studio 2022>=17.4<17.4.15

Microsoft Visual Studio 2022>=17.6<17.6.11

Microsoft Visual Studio 2022>=17.8<17.8.4

All of the following

Any of the following

Microsoft Windows 10 1607

Microsoft Windows 10 1607

Microsoft Windows Server 2008=r2-sp1

Microsoft Windows Server 2012

Microsoft Windows Server 2012=r2

Microsoft Windows Server 2016

Microsoft .NET Framework>=4.8<4.8.04690.02

All of the following

Microsoft Windows Server 2008=r2-sp1

Microsoft .NET Framework>=4.8<4.8.04690.01

All of the following

Any of the following

Microsoft Windows Server 2008=r2-sp1

Microsoft Windows Server 2012

Microsoft Windows Server 2012=r2

Any of the following

Microsoft .NET Framework=4.6.2

Microsoft .NET Framework=4.7

Microsoft .NET Framework=4.7.1

Microsoft .NET Framework=4.7.2

All of the following

Any of the following

Microsoft Windows 10 1809

Microsoft Windows 10 1809

Microsoft Windows 10 21h2

Microsoft Windows 10 21h2

Microsoft Windows 10 21h2

Microsoft Windows 10 22h2

Microsoft Windows 10 22h2

Microsoft Windows 10 22h2

Microsoft Windows 11 21h2

Microsoft Windows 11 21h2

Microsoft Windows 11 22h2

Microsoft Windows 11 22h2

Microsoft Windows 11 23h2

Microsoft Windows 11 23h2

Microsoft Windows Server 2019

Microsoft Windows Server 2022

Microsoft Windows Server 2022 23h2

Any of the following

Microsoft .NET Framework=3.5

Microsoft .NET Framework=4.8.1

All of the following

Any of the following

Microsoft Windows 10 1809

Microsoft Windows 10 1809

Microsoft Windows 10 21h2

Microsoft Windows 10 21h2

Microsoft Windows 10 21h2

Microsoft Windows 10 22h2

Microsoft Windows 10 22h2

Microsoft Windows 10 22h2

Microsoft Windows 11 21h2

Microsoft Windows 11 21h2

Microsoft Windows 11 22h2

Microsoft Windows 11 22h2

Microsoft Windows Server 2019

Microsoft Windows Server 2022

Microsoft Windows Server 2022 23h2

Any of the following

Microsoft .NET Framework>=4.8<4.8.04690.02

Microsoft .NET Framework=3.5

All of the following

Any of the following

Microsoft Windows 10 1607

Microsoft Windows 10 1607

Microsoft Windows 10 1809

Microsoft Windows 10 1809

Microsoft Windows 10 1809

Microsoft Windows Server 2016

Microsoft Windows Server 2019

Any of the following

Microsoft .NET Framework=3.5

Microsoft .NET Framework=4.7.2

All of the following

Microsoft Windows Server 2008=sp2

Microsoft .NET Framework=2.0-sp2

Microsoft .NET>=6.0.0<6.0.26

Microsoft .NET>=7.0.0<7.0.15

Microsoft .NET=8.0.0

Remediation

Patch Available

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056

Event History

Jan 9, 2024

CVE Published

via Microsoft·08:00 AM

Data Sourced

via Microsoft·08:00 AM

DescriptionSeverityWeakness

CVE Published

via MITRE·05:56 PM

Data Sourced

via MITRE·05:56 PM

DescriptionSeverity

Data Sourced

via NVD·06:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Advisory Published

via GitHub·06:30 PM

Frequently Asked Questions

1

What is the severity of CVE-2024-0056?

CVE-2024-0056 is rated as a critical severity vulnerability.

2

How do I fix CVE-2024-0056?

You can fix CVE-2024-0056 by applying the latest security patches provided by Microsoft for the affected products.

3

Which products are affected by CVE-2024-0056?

CVE-2024-0056 affects Microsoft.Data.SqlClient, System.Data.SqlClient, and various versions of the .NET Framework along with SQL Server 2022.

4

Is CVE-2024-0056 exploitable remotely?

Yes, CVE-2024-0056 is exploitable remotely, allowing attackers to bypass security features.

5

What are the potential impacts of exploiting CVE-2024-0056?

Exploiting CVE-2024-0056 could lead to unauthorized access and manipulation of sensitive data.

CVSS Score

8.7High

High Severity

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Security Metrics

Risk Score48

Severityhigh(8.7)

EPSS0.197%

CWE

319

Timeline

PublishedDec 20, 2023

Updated

References

Tags

agent/typeagent/first-publish-dateagent/titlecollector/msrc-cvesource/Microsoftagent/software-canonical-lookupagent/remedyagent/severityagent/referencesagent/authoragent/software-canonical-lookup-requestcollector/epss-latestsource/FIRSTagent/epsscollector/msrcagent/weaknesscollector/github-advisory-latestsource/GitHubalias/GHSA-98g6-xh36-x2p7alias/CVE-2024-0056agent/eventcollector/github-advisoryagent/trendingagent/sourcecollector/redhat-bugzillasource/Red Hatcollector/nvd-cvesource/NVDcollector/nvd-apiagent/tagscollector/mitre-cvesource/MITREagent/last-modified-dateagent/softwarecombineagent/risk-scoreagent/descriptionvendor/microsoftcanonical/microsoft .net 8.0canonical/microsoft .net 6.0canonical/microsoft .net 7.0package-manager/nugetcanonical/microsoft sql server 2022canonical/microsoft.data.sqlclientcanonical/microsoft sql servercanonical/microsoft .net framework 4version/microsoft .net framework 4/2.0version/microsoft .net framework 4/4.6.2version/microsoft .net framework 4/4.7version/microsoft .net framework 4/4.7.1version/microsoft .net framework 4/4.7.2version/microsoft .net framework 4/4.8version/microsoft .net framework 4/3.5version/microsoft .net framework 4/4.8.1package-manager/redhatcanonical/visual studio community 2022version/visual studio community 2022/17.2version/visual studio community 2022/17.4version/visual studio community 2022/17.6version/visual studio community 2022/17.8version/microsoft.data.sqlclient/2.1version/microsoft.data.sqlclient/3.1version/microsoft.data.sqlclient/4.0version/microsoft.data.sqlclient/5.1version/microsoft sql server/2022version/microsoft sql server/2022-cumulative_update_10canonical/microsoft windows 10canonical/microsoft windows serverversion/microsoft windows server/r2-sp1version/microsoft windows server/r2canonical/microsoft windows server 2016canonical/windows 11canonical/microsoft windows server 2019canonical/microsoft windows server 2022version/microsoft windows server/sp2version/microsoft .net framework 4/2.0-sp2canonical/microsoft .net frameworkversion/microsoft .net framework/6.0.0version/microsoft .net framework/7.0.0version/microsoft .net framework/8.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203