CVE-2024-43468: Microsoft Configuration Manager SQL Injection Vulnerability
Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.
Other sources
Microsoft Configuration Manager Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.00.9128 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.00.9122 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.00.9106
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43468?
CVE-2024-43468 has been classified as a remote code execution vulnerability, indicating a high severity risk.
What versions of Microsoft Configuration Manager are affected by CVE-2024-43468?
CVE-2024-43468 affects Microsoft Configuration Manager versions 2303, 2309, and 2403.
How do I fix CVE-2024-43468?
To fix CVE-2024-43468, apply the latest patches available for the affected versions of Microsoft Configuration Manager.
What type of vulnerability is CVE-2024-43468?
CVE-2024-43468 is a remote code execution vulnerability that could allow an attacker to execute arbitrary code.
How can CVE-2024-43468 impact my organization?
CVE-2024-43468 can potentially allow attackers to gain unauthorized access to critical systems, leading to data breaches and operational disruptions.