CVE-2023-21704
Full vulnerability record from the local CVENow database.
Description
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2023-02-14 20:15:13.753000
Last modified
2026-11-02 23:17:13.327000
View original CVE JSON
{
"id": "CVE-2023-21704",
"sourceIdentifier": "[email protected]",
"published": "2023-02-14T20:15:13.753",
"lastModified": "2026-11-02T23:17:13.327",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability"
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecución de código remota de Microsoft ODBC Driver para SQL Server"
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2014 Service Pack 3 (CU 4)",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "12.0.0",
"lessThan": "12.0.6174.8",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2014 Service Pack 3 (GDR)",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "12.0.0",
"lessThan": "12.0.6444.4",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2016 Service Pack 3 (GDR)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "13.0.0",
"lessThan": "13.0.6430.49",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "13.0.0",
"lessThan": "13.0.7024.30",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2017 (CU 31)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "14.0.0",
"lessThan": "14.0.3460.9",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2017 (GDR)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "14.0.0",
"lessThan": "14.0.2047.8",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2019 (CU 18)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "15.0.0",
"lessThan": "15.0.4280.7",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2019 (GDR)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "15.0.0",
"lessThan": "15.0.2101.7",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2022 (GDR)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "16.0.0",
"lessThan": "16.0.1050.5",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-06-03T18:50:10.599327Z",
"id": "CVE-2023-21704",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-190"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:*:*",
"matchCriteriaId": "03C65D96-44D0-4411-8B84-961973F1E4D0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server:2016:sp3:*:*:*:*:x64:*",
"matchCriteriaId": "39A3D29F-0BE0-4F78-9970-58BB355775DE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server:2017:*:*:*:*:*:x64:*",
"matchCriteriaId": "2FF9FC32-3E6E-4256-B6BD-C4EF1932CA18"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:*",
"matchCriteriaId": "9144F644-A3D4-440C-8978-257E71204617"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server:2022:*:*:*:*:*:x64:*",
"matchCriteriaId": "6CB7AD22-F27B-4807-88F1-02ED420421D5"
}
]
}
]
}
],
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21704",
"source": "[email protected]",
"tags": [
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21704",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
]
}
]
}