CVE-2020-0618
Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA notes
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-0618 ; https://nvd.nist.gov/vuln/detail/CVE-2020-0618
Description
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Microsoft SQL Server | 2012 for 32-bit Systems Service Pack 4 (QFE) 2012 for x64-based Systems Service Pack 4 (QFE) 2016 for x64-based Systems Service Pack 2 (CU) |
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) | unspecified |
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) | unspecified |
| Microsoft | Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) | unspecified |
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR) | unspecified |
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU) | unspecified |
References
3 Links- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618
- http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html
- http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html
Record Details
More from Microsoft
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.