Lucene search

[email protected]CVE-2020-0618

HistoryFeb 11, 2020 - 10:15 p.m.

CVE-2020-0618

2020-02-1122:15:13

CWE-502

[email protected]

web.nvd.nist.gov

1145

cve-2020-0618

microsoft

sql server

reporting services

remote code execution

vulnerability

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.974 High

EPSS

Percentile

99.9%

JSON

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka ‘Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability’.

Affected configurations

Vulners

NVD

Node

microsoftsql_server

microsoftsql_serverRangeunspecified–2014service pack 3

microsoftsql_serverRangeunspecified–2016service pack 2

microsoftsql_serverRangeunspecified–2014service pack 3

VendorProductVersionCPE
microsoftsql_server*cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:*:*
microsoftsql_server*cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:*:*
microsoftsql_server*cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:*:*
microsoftsql_server*cpe:2.3:a:microsoft:sql_server:*:service pack 3:*:*:*:*:*:*
microsoftsql_server*cpe:2.3:a:microsoft:sql_server:*:service pack 3:*:*:*:*:*:*
microsoftsql_server*cpe:2.3:a:microsoft:sql_server:*:service pack 2:*:*:*:*:*:*
microsoftsql_server*cpe:2.3:a:microsoft:sql_server:*:service pack 3:*:*:*:*:*:*
microsoftsql_server*cpe:2.3:a:microsoft:sql_server:*:service pack 3:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	sql_server	*	cpe:2.3:a:microsoft:sql_server::::::::
microsoft	sql_server	*	cpe:2.3:a:microsoft:sql_server::::::::
microsoft	sql_server	*	cpe:2.3:a:microsoft:sql_server::::::::
microsoft	sql_server	*	cpe:2.3:a:microsoft:sql_server::service pack 3::::::*
microsoft	sql_server	*	cpe:2.3:a:microsoft:sql_server::service pack 3::::::*
microsoft	sql_server	*	cpe:2.3:a:microsoft:sql_server::service pack 2::::::*
microsoft	sql_server	*	cpe:2.3:a:microsoft:sql_server::service pack 3::::::*
microsoft	sql_server	*	cpe:2.3:a:microsoft:sql_server::service pack 3::::::*

CNA Affected

[
  {
    "product": "Microsoft SQL Server",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "2012 for 32-bit Systems Service Pack 4 (QFE)"
      },
      {
        "status": "affected",
        "version": "2012 for x64-based Systems Service Pack 4 (QFE)"
      },
      {
        "status": "affected",
        "version": "2016 for x64-based Systems Service Pack 2 (CU)"
      }
    ]
  },
  {
    "product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "unspecified"
      }
    ]
  },
  {
    "product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "unspecified"
      }
    ]
  },
  {
    "product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "unspecified"
      }
    ]
  },
  {
    "product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "unspecified"
      }
    ]
  },
  {
    "product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "unspecified"
      }
    ]
  }
]