CVE-2025-59250 - Vulnerability Details - OpenCVE

Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250

History

Tue, 14 Oct 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 14 Oct 2025 17:15:00 +0000

Type	Values Removed	Values Added
Description		Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
Title		JDBC Driver for SQL Server Spoofing Vulnerability
Weaknesses		CWE-20
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2025-10-14T17:00:42.700Z

Updated: 2025-10-24T23:07:43.554Z

Reserved: 2025-09-11T04:30:28.170Z

Link: CVE-2025-59250

Vulnrichment

Updated: 2025-10-14T19:36:24.603Z

NVD

Status : Awaiting Analysis

Published: 2025-10-14T17:16:07.240

Modified: 2025-10-14T19:35:56.913

Link: CVE-2025-59250

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59250", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-09-11T04:30:28.170Z", "datePublished": "2025-10-14T17:00:42.700Z", "dateUpdated": "2025-10-24T23:07:43.554Z"}, "containers": {"cna": {"title": "JDBC Driver for SQL Server Spoofing Vulnerability", "datePublic": "2025-10-14T07:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.4:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "12.4.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.2:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "12.2.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.8:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "12.8.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_10.2:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "10.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_11.2:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "11.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.6:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "12.6.5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_13.2:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "13.2.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.10:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "12.10.2"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 12.4", "platforms": ["Unknown"], "versions": [{"version": "1.0.0", "lessThan": "12.4.3", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 12.2", "platforms": ["Unknown"], "versions": [{"version": "1.0.0", "lessThan": "12.2.1", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 12.8", "platforms": ["Unknown"], "versions": [{"version": "1.0.0", "lessThan": "12.8.2", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 10.2", "platforms": ["Unknown"], "versions": [{"version": "1.0.0", "lessThan": "10.2.4", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 11.2", "platforms": ["Unknown"], "versions": [{"version": "1.0.0", "lessThan": "11.2.4", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 12.6", "platforms": ["Unknown"], "versions": [{"version": "1.0.0", "lessThan": "12.6.5", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 13.2", "platforms": ["Unknown"], "versions": [{"version": "1.0.0", "lessThan": "13.2.1", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 12.10", "platforms": ["Unknown"], "versions": [{"version": "1.0.0", "lessThan": "12.10.2", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-20: Improper Input Validation", "lang": "en-US", "type": "CWE", "cweId": "CWE-20"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-10-24T23:07:43.554Z"}, "references": [{"name": "JDBC Driver for SQL Server Spoofing Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-16T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-59250"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-17T03:55:29.997Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59250", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-14T19:36:23.700377Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T19:36:24.603Z"}}], "cna": {"title": "JDBC Driver for SQL Server Spoofing Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 12.4", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "12.4.3", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 12.2", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "12.2.1", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 12.8", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "12.8.2", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 10.2", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "10.2.4", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 11.2", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "11.2.4", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 12.6", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "12.6.5", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 13.2", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "13.2.1", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft JDBC Driver for SQL Server 12.10", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "12.10.2", "versionType": "custom"}], "platforms": ["Unknown"]}], "datePublic": "2025-10-14T07:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250", "name": "JDBC Driver for SQL Server Spoofing Vulnerability", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.4:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.4.3", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.2.1", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.8:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.8.2", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_10.2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.2.4", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_11.2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "11.2.4", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.6:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.6.5", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_13.2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "13.2.1", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.10:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.10.2", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-10-24T23:07:43.554Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59250", "state": "PUBLISHED", "dateUpdated": "2025-10-24T23:07:43.554Z", "dateReserved": "2025-09-11T04:30:28.170Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2025-10-14T17:00:42.700Z", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}