Microsoft » Sql Server : Security Vulnerabilities, CVEs, Published In 2002 CVSS score >= 9
The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and Microsoft Desktop Engine (MSDE) 2000 can be executed by PUBLIC, which allows an attacker to gain privileges by updating a webtask that is owned by the database owner through the msdb.dbo.mswebtasks table, which does not have strong permissions.
Max CVSS
10.0
EPSS Score
1.46%
Published
2002-10-28
Updated
2018-10-12
Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users, and possibly remote attackers, to run stored procedures with administrator privileges via (1) xp_execresultset, (2) xp_printstatements, or (3) xp_displayparamstmt.
Max CVSS
10.0
EPSS Score
6.16%
Published
2002-09-05
Updated
2018-10-12
2 vulnerabilities found