CVEvulnerability
CVE-2016-7253
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-11-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Server Agent Elevation of Privilege Vulnerability."
Affected configurations
• microsoft sql server 2012
• microsoft sql server 2014
Related
Weakness · not in database (1)
References
- http://www.securityfocus.com/bid/94056 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037250 www.securitytracker.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-136 docs.microsoft.com
- http://www.securityfocus.com/bid/94056 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037250 www.securitytracker.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-136 docs.microsoft.com