Back to board Open MSRC
MSRC compact vulnerability detail

CVE-2023-38151 · Microsoft Host Integration Server 2020 Remote Code Execution Vulnerability

No description was published by MSRC.

Severity
Important
Impact
Remote Code Execution
CVSS
8.8 base · 7.7 temporal
Release
2023-11-14
Signals
Azure Remote Code Execution Exploited: No Publicly disclosed: No Exploitability: Exploitation Less Likely
CWE
CWE-908: Use of Uninitialized Resource
Patch Diff
Loading module diff metadata...
Resolved binary override
Use this when the MSRC module name cannot be mapped automatically or the resolved binary looks wrong.
Old version New version
Description
No description was published by MSRC.
FAQ / Articles
FAQ
How could an attacker exploit this vulnerability? Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the target machine if the victim connects to the attacker's malicious DB2 server and they execute a specially crafted query.
Mitigation
The following mitigating factors might be helpful in your situation: The victim must have installed Microsoft OLE DB Provider for DB2 Server Version 7.0 for the target machine to be vulnerable.