KLA12455 Multiple vulnerabilities in Microsoft SQL Server

Multiple vulnerabilities were found in Microsoft SQL Server. Malicious users can exploit these vulnerabilities to obtain sensitive information, gain privileges.

Below is a complete list of vulnerabilities:

1. An information disclosure vulnerability in Microsoft Power BI can be exploited remotely to obtain sensitive information.
2. An elevation of privilege vulnerability in SQL Server for Linux Containers can be exploited remotely to gain privileges.

Original advisories

CVE-2022-23254

CVE-2022-23276

Related products

Microsoft-SQL-Server

CVE list

CVE-2022-23254 warning

CVE-2022-23276 critical

KB list

5010657

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• PowerBI-client JS SDKSQL Server 2019 for Linux Containers