CVE-2024-0056

Summary

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Affected Software

VendorProductVersion RangeStatus
MicrosoftMicrosoft SQL Server 2022 (GDR)16.0.0 < 16.0.1110.1affected
Microsoft.NET 6.06.0.0 < 6.0.26affected
Microsoft.NET 7.07.0.0 < 7.0.15affected
Microsoft.NET 8.08.0 < 8.0.1affected
MicrosoftMicrosoft.Data.SqlClient2.0 < 2.1.7affected
MicrosoftMicrosoft.Data.SqlClient3.0 < 3.1.5affected
MicrosoftMicrosoft.Data.SqlClient4.0 < 4.0.5affected
MicrosoftMicrosoft.Data.SqlClient5.0 < 5.1.3affected
MicrosoftSystem.Data.SqlClient1.0 < 4.8.6affected
MicrosoftMicrosoft Visual Studio 2022 version 17.217.2.0 < 17.2.23affected
MicrosoftMicrosoft Visual Studio 2022 version 17.417.4.0 < 17.4.15affected
MicrosoftMicrosoft Visual Studio 2022 version 17.617.6.0 < 17.6.11affected
MicrosoftMicrosoft Visual Studio 2022 version 17.817.8.0 < 17.8.4affected
MicrosoftMicrosoft SQL Server 2022 (CU 10)0 < 16.0.4100.1affected
MicrosoftMicrosoft .NET Framework 4.84.8.0 < 4.8.04690.02affected
MicrosoftMicrosoft .NET Framework 3.5 AND 4.84.8.0 < 4.8.04690.02affected
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.24.7.0 < 4.7.04081.03affected
MicrosoftMicrosoft .NET Framework 4.6.2/4.7/4.7.1/4.7.24.7.0 < 4.7.04081.02affected
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8.14.8.1 < 4.8.09214.01affected
MicrosoftMicrosoft .NET Framework 2.0 Service Pack 22.0.0 < 3.0.50727.8976affected

Weaknesses

  • CWE-319: CWE-319: Cleartext Transmission of Sensitive Information

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References