Skip to main content

Visual Studio 2022 CVE-2024-0056

HIGH
Cleartext Transmission of Sensitive Information (CWE-319)
2024-01-09 secure@microsoft.com
Authentication Bypass Microsoft Visual Studio 2022 Net Net Framework Microsoft Data Sqlclient Sql Server System Data Sqlclient
8.7
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-319
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V12 - Secure Communication Transport encryption
Impact

CVSS score of 8.7 (HIGH). Attack characteristics: network attack vector, high complexity, no privileges required, no user interaction not required. EPSS exploitation probability: 0.86%.
Exploit ScenarioDerived

This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the high-severity affected system.
This Month Plan within 30 days. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affected Packages

nuget microsoft.data.sqlclient fix: 2.1.7, 3.1.5, 4.0.5, 5.1.3
nuget system.data.sqlclient fix: 4.8.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in nuget

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-319. Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability Affected products include: Microsoft Microsoft.Data.Sqlclient, Microsoft Sql Server, Microsoft System.Data.Sqlclient, Microsoft Visual Studio 2022, Microsoft .Net Framework.

Know when Visual Studio 2022 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.7 HIGH
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
Patch released
Mar 28, 2026 - 19:34 nvd
Patch available
CVE Published
Jan 09, 2024 - 18:15 nvd
HIGH 8.7

DescriptionCVE.org

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Executive ViewAI

Why It Matters

CVE-2024-0056 presents significant security risk rated CVSS 8.7. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. A patch is available and should be applied as part of regular vulnerability management.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.9%
Top 25% exploitable

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.9%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Very High

Priority Score

45
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:microsoft:microsoft.data.sqlclient:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft.data.sqlclient:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft.data.sqlclient:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft.data.sqlclient:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2022:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sql_server:2022:cumulative_update_10:*:*:*:*:*:*
cpe:2.3:a:microsoft:system.data.sqlclient:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*
+ 7 more

More in Visual Studio 2022

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2023-38180 HIGH
7.5 Aug 08

.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
CVE-2025-26682 HIGH
7.5 Apr 08

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
CVE-2025-55315 CRITICAL POC
9.9

ASP.NET Core Kestrel request smuggling allows a low-privileged network attacker (PR:L, no user interaction) to desynchro
CVE-2026-69439 HIGH POC
8.8 Sep 08

Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker
CVE-2026-71328 HIGH POC
8.8 Sep 08

Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
CVE-2026-62886 HIGH POC
7.8 Aug 11

Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
CVE-2026-62871 HIGH POC
7.8 Aug 11

Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
CVE-2026-70354 HIGH POC
7.8 Aug 11

Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full

CVE-2026-62909 HIGH POC
7.8 Aug 11

Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows

CVE-2026-62901 HIGH POC
7.5 Aug 11

Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang

CVE-2026-62897 HIGH POC
7.0 Aug 11

Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com

Same weakness CWE-319 – Cleartext Transmission of Sensitive Information

View all
CVE-2022-43551 HIGH POC
7.5
CVE-2025-26199 CRITICAL POC
9.8
CVE-2025-32880 CRITICAL POC
9.8
CVE-2023-33730 CRITICAL POC
9.8
CVE-2019-15911 CRITICAL POC
9.8
CVE-2019-18852 CRITICAL POC
9.8
CVE-2023-23914 CRITICAL POC
9.1
CVE-2024-25735 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

References

Advisories & patches
PATCH https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy