CVEvulnerability

CVE-2015-9098

9.8 CRITICAL Published 2017-06-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-06-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-89

Description

In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execute arbitrary SQL commands on any monitored Microsoft SQL Server machines. If the Base Monitor is connecting to these machines using an account with SQL admin privileges, then code execution on the operating system can result in full system compromise (if Microsoft SQL Server is running with local administrator privileges).

Affected configurations

• red-gate sql monitor (<= 3.5) • red-gate sql monitor 4.0 • red-gate sql monitor 4.1

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References