Microsoft SQL Elevation of Privilege Vulnerability
Microsoft · Microsoft SQL Server 2012 Service Pack 4 (QFE)
Heading is the official description · CVE.orgSource dataSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. Copied from CVE.org.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown.Breakdown
70.4 / 100
Exploited
Yes, in VulnCheck KEV
Reports
1
Tactics
0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 13 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 14 months after disclosure.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linked
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Named in 1 threat reportMachineMachine-matchedFound by keyword or pattern matching over threat-report text. Not reviewed by a person. Exact CVE id found in the report text.
1 reportSymantec
Reports are matched by finding the exact id CVE-2021-1636 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
UPDATE February 25, 2022, 17:00: This blog has been updated with details on how a known Microsoft SQL Server vulnerability (CVE-2021-1636) was exploited in at least one attack.