CVE-2002-0721 Privilege escalation in n/a
Unprivileged users can execute extended stored procedures with administrator privileges due to weak default permissions in Microsoft SQL Server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2002-0721?
CVE-2002-0721 is a critical vulnerability in Microsoft Sql Server, published on 20 Aug 2002. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users, and possibly remote attackers, to run stored procedures with administrator privileges via (1) xp_execresultset, (2) xp_printstatements, or (3) xp_displayparamstmt.
Which versions are affected by CVE-2002-0721?
It affects 2 products.
Products include Microsoft Data Engine, Microsoft Sql Server.
How do I fix CVE-2002-0721?
No fix has been published for CVE-2002-0721 yet. Limit exposure of the affected software until one is available.
Is CVE-2002-0721 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2002-0721 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Microsoft Sql Server
Sources
Also known as GHSA-277j-v78r-mm9w.