CVE-2015-9098

high-risk
Published 2017-06-22

In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execute arbitrary SQL commands on any monitored Microsoft SQL Server machines. If the Base Monitor is connecting to these machines using an account with SQL admin privileges, then code execution on the operating system can result in full system compromise (if Microsoft SQL Server is running with local administrator privileges).

Do I need to act?

!
40.0% chance of exploitation in next 30 days
EPSS score — higher than 60% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
42444
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (3)

Sql Monitor
Sql Monitor
Sql Monitor

Affected Vendors

Red-Gate

References (4)

Vendor Advisory http://www.red-gate.com/products/dba/sql-monitor/entrypage/security-vulnerabilit...
Third Party Advisory https://www.exploit-db.com/exploits/42444/
Vendor Advisory http://www.red-gate.com/products/dba/sql-monitor/entrypage/security-vulnerabilit...
Third Party Advisory https://www.exploit-db.com/exploits/42444/
58
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 17/34 · Moderate
Exposure 9/34 · Low