Azure Sql Database
Monthly
Privilege elevation via SQL injection (CWE-89) affects Microsoft Azure SQL Database, where an already-authorized attacker can inject unneutralized special elements into SQL commands over the network to gain higher privileges than granted. The 9.9 CVSS score reflects a scope change (S:C) with high confidentiality, integrity, and availability impact, meaning a low-privileged database principal could break out of its authorization boundary. Microsoft has released a fix, and there is no public exploit identified at time of analysis.
Privilege elevation in Microsoft Azure SQL Database lets an already-authenticated, high-privileged principal escalate its permissions over the network through an improper access-control check (CWE-284). The CVSS scope change (S:C) indicates the abuse crosses an intended trust boundary within the managed service, threatening confidentiality, integrity, and availability. No public exploit identified at time of analysis and the flaw is not in CISA KEV; Microsoft has addressed it server-side per its MSRC advisory.
Privilege escalation in Microsoft Azure SQL Database allows an already-authenticated, low-privileged attacker to inject crafted SQL over the network and gain elevated database privileges. Rated CVSS 9.9 with a scope-changing vector, the flaw stems from improper neutralization of special elements in SQL commands (CWE-89); Microsoft has issued a service-side fix. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in Azure SQL Database allows a locally authenticated attacker to gain elevated permissions through incorrect permission assignment on a critical resource. The flaw is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource), meaning a resource - likely a file, registry key, named pipe, or shared object - is accessible with overly permissive settings. An attacker with existing local access and low-privilege credentials could exploit this to achieve high confidentiality, integrity, and availability impact on the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis.
Elevation of privilege in Microsoft Azure SQL Database lets an unauthorized network attacker bypass authentication and gain higher privileges, with a maximum CVSS 10.0 and a scope change indicating the flaw extends impact beyond the initially vulnerable component. The CVSS vector (PR:N/UI:N) means no credentials or user interaction are required, making this a critical priority despite no public exploit being identified. As a managed cloud service, remediation is handled server-side by Microsoft rather than by customer patching.
Privilege elevation via SQL injection (CWE-89) affects Microsoft Azure SQL Database, where an already-authorized attacker can inject unneutralized special elements into SQL commands over the network to gain higher privileges than granted. The 9.9 CVSS score reflects a scope change (S:C) with high confidentiality, integrity, and availability impact, meaning a low-privileged database principal could break out of its authorization boundary. Microsoft has released a fix, and there is no public exploit identified at time of analysis.
Privilege elevation in Microsoft Azure SQL Database lets an already-authenticated, high-privileged principal escalate its permissions over the network through an improper access-control check (CWE-284). The CVSS scope change (S:C) indicates the abuse crosses an intended trust boundary within the managed service, threatening confidentiality, integrity, and availability. No public exploit identified at time of analysis and the flaw is not in CISA KEV; Microsoft has addressed it server-side per its MSRC advisory.
Privilege escalation in Microsoft Azure SQL Database allows an already-authenticated, low-privileged attacker to inject crafted SQL over the network and gain elevated database privileges. Rated CVSS 9.9 with a scope-changing vector, the flaw stems from improper neutralization of special elements in SQL commands (CWE-89); Microsoft has issued a service-side fix. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in Azure SQL Database allows a locally authenticated attacker to gain elevated permissions through incorrect permission assignment on a critical resource. The flaw is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource), meaning a resource - likely a file, registry key, named pipe, or shared object - is accessible with overly permissive settings. An attacker with existing local access and low-privilege credentials could exploit this to achieve high confidentiality, integrity, and availability impact on the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis.
Elevation of privilege in Microsoft Azure SQL Database lets an unauthorized network attacker bypass authentication and gain higher privileges, with a maximum CVSS 10.0 and a scope change indicating the flaw extends impact beyond the initially vulnerable component. The CVSS vector (PR:N/UI:N) means no credentials or user interaction are required, making this a critical priority despite no public exploit being identified. As a managed cloud service, remediation is handled server-side by Microsoft rather than by customer patching.