CVE-2015-9098

Critical

Published: 22/06/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In Redgate SQL Monitor before version 3.10 and 4.x before version 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, allowing for the execution of arbitrary SQL commands on monitored Microsoft SQL Server machines.

Risk Assessment

If the Base Monitor connects to these machines using an account with SQL admin privileges, it can lead to code execution on the operating system and full system compromise.

Recommendation

It is recommended to update Redgate SQL Monitor to the latest version to mitigate the risk of unauthorized access and potential system compromise.

Original NVD description (English source)

In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execute arbitrary SQL commands on any monitored Microsoft SQL Server machines. If the Base Monitor is connecting to these machines using an account with SQL admin privileges, then code execution on the operating system can result in full system compromise (if Microsoft SQL Server is running with local administrator privileges).