CVE-2024-43474
Published: 10 September 2024
Summary
CVE-2024-43474 is a high-severity Improper Null Termination (CWE-170) vulnerability in Microsoft Sql Server 2017. Its CVSS base score is 7.6 (High).
Operationally, ranked in the top 8.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-43474 is an information disclosure vulnerability in Microsoft SQL Server, assigned a CVSS 3.1 score of 7.6 with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. The flaw is also associated with CWE-170. It was published on 2024-09-10 and affects the database server component when accessed over a network.
An authenticated attacker with low privileges can exploit the issue remotely without user interaction to disclose sensitive information at high impact, while also producing limited integrity and availability effects on the target instance.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43474 supplies official mitigation and patch guidance for affected SQL Server versions.
The associated EPSS score has remained low, with a current value of 0.0673 and a peak of 0.0835.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40741
Vulnerability details
Microsoft SQL Server Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.