high8.7
CVE-2024-0056
Microsoft.Data.SqlClient and System.Data.SqlClient vulnerable to SQL Data Provider Security Feature Bypass
Impact
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Microsoft.Data.SqlClient | < 2.1.7 | 2.1.7 |
| nuget | System.Data.SqlClient | < 4.8.6 | 4.8.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Microsoft.Data.Sqlclient | from 2.1 before 2.1.7 from 3.1 before 3.1.5 from 4.0 before 4.0.5 from 5.1 before 5.1.3 |
| Microsoft | Sql Server | Version 2022 |
| Microsoft | System.Data.Sqlclient | before 4.8.6 |
| Microsoft | Visual Studio 2022 | from 17.2 before 17.2.23 from 17.4 before 17.4.15 from 17.6 before 17.6.11 from 17.8 before 17.8.4 |
| Microsoft | .Net Framework | from 4.8 before 4.8.04690.02 from 4.8 before 4.8.04690.01 Versions 4.6.2, 4.7, 4.7.1, 4.7.2 |
| Microsoft | .Net | from 6.0.0 before 6.0.26 from 7.0.0 before 7.0.15 Version 8.0.0 |