{"id":"CVE-2023-21705","state":"PUBLISHED","title":"Microsoft SQL Server Remote Code Execution Vulnerability","description":"Microsoft SQL Server Remote Code Execution Vulnerability","publishedAt":"2023-02-14T19:32:43.252Z","updatedAt":"2026-08-19T16:26:36.100Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE)","Microsoft Microsoft SQL Server 2012 Service Pack 4 (QFE)","Microsoft Microsoft SQL Server 2014 Service Pack 3 (CU 4)","Microsoft Microsoft SQL Server 2014 Service Pack 3 (GDR)","Microsoft Microsoft SQL Server 2016 Service Pack 3 (GDR)","Microsoft Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack","Microsoft Microsoft SQL Server 2017 (CU 31)","Microsoft Microsoft SQL Server 2017 (GDR)","Microsoft Microsoft SQL Server 2019 (CU 18)","Microsoft Microsoft SQL Server 2019 (GDR)","Microsoft Microsoft SQL Server 2022 (GDR)"],"affected":[{"vendor":"Microsoft","product":"Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE)","versions":[{"version":"11.0.0","status":"affected","lessThan":"11.0.7512.11","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2012 Service Pack 4 (QFE)","versions":[{"version":"11.0.0","status":"affected","lessThan":"11.0.7512.11","versionType":"custom"}],"platforms":["32-bit Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2014 Service Pack 3 (CU 4)","versions":[{"version":"12.0.0","status":"affected","lessThan":"12.0.6174.8","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2014 Service Pack 3 (GDR)","versions":[{"version":"12.0.0","status":"affected","lessThan":"12.0.6444.4","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2016 Service Pack 3 (GDR)","versions":[{"version":"13.0.0","status":"affected","lessThan":"13.0.6430.49","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack","versions":[{"version":"13.0.0","status":"affected","lessThan":"13.0.7024.30","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2017 (CU 31)","versions":[{"version":"14.0.0","status":"affected","lessThan":"14.0.3460.9","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2017 (GDR)","versions":[{"version":"14.0.0","status":"affected","lessThan":"14.0.2047.8","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2019 (CU 18)","versions":[{"version":"15.0.0","status":"affected","lessThan":"15.0.4280.7","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2019 (GDR)","versions":[{"version":"15.0.0","status":"affected","lessThan":"15.0.2101.7","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2022 (GDR)","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.1050.5","versionType":"custom"}],"platforms":["x64-based Systems"]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21705"],"weaknesses":["CWE-321"],"ingestedAt":"2026-10-29T20:05:36.141Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/21xxx/CVE-2023-21705.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-21705","state":"PUBLISHED","datePublished":"2023-02-14T19:32:43.252Z","dateUpdated":"2026-08-19T16:26:36.100Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2022-12-13T18:08:03.490Z"},"containers":{"cna":{"title":"Microsoft SQL Server Remote Code Execution Vulnerability","descriptions":[{"lang":"en-US","value":"Microsoft SQL Server Remote Code Execution Vulnerability"}],"affected":[{"vendor":"Microsoft","product":"Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE)","versions":[{"version":"11.0.0","status":"affected","lessThan":"11.0.7512.11","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2012 Service Pack 4 (QFE)","versions":[{"version":"11.0.0","status":"affected","lessThan":"11.0.7512.11","versionType":"custom"}],"platforms":["32-bit Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2014 Service Pack 3 (CU 4)","versions":[{"version":"12.0.0","status":"affected","lessThan":"12.0.6174.8","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2014 Service Pack 3 (GDR)","versions":[{"version":"12.0.0","status":"affected","lessThan":"12.0.6444.4","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2016 Service Pack 3 (GDR)","versions":[{"version":"13.0.0","status":"affected","lessThan":"13.0.6430.49","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack","versions":[{"version":"13.0.0","status":"affected","lessThan":"13.0.7024.30","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2017 (CU 31)","versions":[{"version":"14.0.0","status":"affected","lessThan":"14.0.3460.9","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2017 (GDR)","versions":[{"version":"14.0.0","status":"affected","lessThan":"14.0.2047.8","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2019 (CU 18)","versions":[{"version":"15.0.0","status":"affected","lessThan":"15.0.4280.7","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2019 (GDR)","versions":[{"version":"15.0.0","status":"affected","lessThan":"15.0.2101.7","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft SQL Server 2022 (GDR)","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.1050.5","versionType":"custom"}],"platforms":["x64-based Systems"]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21705","name":"Microsoft SQL Server Remote Code Execution Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":8.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-321","description":"CWE-321: Use of Hard-coded Cryptographic Key","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-08-19T16:26:36.100Z"},"datePublic":"2023-02-14T08:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:*:sp4:*:*:*:*:*:*","versionStartIncluding":"11.0.0","versionEndExcluding":"11.0.7512.11"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:*:sp4:*:*:*:*:*:*","versionStartIncluding":"11.0.0","versionEndExcluding":"11.0.7512.11"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*","versionStartIncluding":"14.0.0","versionEndExcluding":"14.0.2047.8"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:*","versionStartIncluding":"12.0.0","versionEndExcluding":"12.0.6444.4"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:*","versionStartIncluding":"12.0.0","versionEndExcluding":"12.0.6174.8"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*","versionStartIncluding":"15.0.0","versionEndExcluding":"15.0.2101.7"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:*","versionStartIncluding":"13.0.0","versionEndExcluding":"13.0.6430.49"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:*","versionStartIncluding":"13.0.0","versionEndExcluding":"13.0.7024.30"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*","versionStartIncluding":"14.0.0","versionEndExcluding":"14.0.3460.9"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.1050.5"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*","versionStartIncluding":"15.0.0","versionEndExcluding":"15.0.4280.7"}]}]}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21705","name":"Microsoft SQL Server Remote Code Execution Vulnerability","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T09:44:02.069Z"}}]}}}