GHSA-98g6-xh36-x2p7

Source

https://github.com/advisories/GHSA-98g6-xh36-x2p7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-98g6-xh36-x2p7/GHSA-98g6-xh36-x2p7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-98g6-xh36-x2p7

Aliases

Published

2024-01-09T18:30:27Z

Modified

2024-05-31T20:48:39.831563Z

Severity

8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Microsoft.Data.SqlClient and System.Data.SqlClient vulnerable to SQL Data Provider Security Feature Bypass

Details

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-16T19:13:48Z",
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-319"
    ],
    "nvd_published_at": "2024-01-09T18:15:46Z"
}

References

Affected packages

NuGet

Microsoft.Data.SqlClient

Package

Name: Microsoft.Data.SqlClient; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.Data.SqlClient

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.7

Affected versions

1.*

1.0.19123.2-Preview

1.0.19128.1-Preview

1.0.19189.1-Preview

1.0.19221.1-Preview

1.0.19239.1

1.0.19249.1

1.0.19269.1

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

2.*

2.0.0

2.0.1

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

System.Data.SqlClient

Package

Name: System.Data.SqlClient; View open source insights on deps.dev
Purl: pkg:nuget/System.Data.SqlClient

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.8.6

Affected versions

1.*

1.0.0-beta1

1.0.0-beta2

4.*

4.0.0-beta-22605

4.0.0-beta-22816

4.0.0-beta-23019

4.0.0-beta-23109

4.0.0-beta-23123

4.0.0-beta-23225

4.0.0-beta-23409

4.0.0-beta-23516

4.1.0-rc2-24027

4.1.0

4.3.0-preview1-24530-04

4.3.0

4.3.1

4.4.0-preview1-25305-02

4.4.0-preview2-25405-01

4.4.0

4.4.1

4.4.2

4.4.3

4.5.0-preview1-26216-02

4.5.0-preview2-26406-04

4.5.0-rc1

4.5.0

4.5.1

4.5.3

4.6.0-preview2-26905-02

4.6.0-preview3-27014-02

4.6.0

4.6.1

4.7.0

4.8.0

4.8.1

4.8.2

4.8.3

4.8.4

4.8.5

Microsoft.Data.SqlClient

Package

Name: Microsoft.Data.SqlClient; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.Data.SqlClient

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.1.5

Affected versions

3.*

3.0.0

3.0.1

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

Microsoft.Data.SqlClient

Package

Name: Microsoft.Data.SqlClient; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.Data.SqlClient

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.0.5

Affected versions

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

Microsoft.Data.SqlClient

Package

Name: Microsoft.Data.SqlClient; View open source insights on deps.dev
Purl: pkg:nuget/Microsoft.Data.SqlClient

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.1.3

Affected versions

5.*

5.0.0

5.0.1

5.0.2

5.1.0

5.1.1

5.1.2