CVE-2018-8532

🗓️ 10 Oct 2018 13:00:00Reported by microsoftType

cve🔗 web.nvd.nist.gov👁 116 Views🌐 WEB

Information disclosure vulnerability in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XMLA fil

Reporter	Title	Published	Views	Family All 23
zdt	Microsoft SQL Server Management Studio 17.9 - .xmla XML External Entity Injection Vulnerability	11 Oct 201800:00	–	zdt
ATTACKERKB	CVE-2018-8532	10 Oct 201813:29	–	attackerkb
ATTACKERKB	CVE-2018-8533	10 Oct 201813:29	–	attackerkb
ATTACKERKB	CVE-2018-8527	10 Oct 201813:29	–	attackerkb
BDU FSTEC	The vulnerability of Microsoft SQL Server Management Studio, related to errors in restricting XML references to external objects (XXE), allows attackers to disclose sensitive information.	15 Jan 201900:00	–	bdu_fstec
Circl	CVE-2018-8532	11 Oct 201800:00	–	circl
CNVD	Microsoft SQL Server Management Studio Information Disclosure Vulnerability (CNVD-2019-01572)	10 Oct 201800:00	–	cnvd
Check Point Advisories	Microsoft SQL Server Management Studio XXE Injection Information Disclosure (CVE-2018-8527; CVE-2018-8532; CVE-2018-8533)	18 Nov 201800:00	–	checkpoint_advisories
Cvelist	CVE-2018-8532	10 Oct 201813:00	–	cvelist
Exploit DB	Microsoft SQL Server Management Studio 17.9 - '.xmla' XML External Entity Injection	11 Oct 201800:00	–	exploitdb

NVD

Node

microsoft sql_server_management_studioMatch17.9

microsoft sql_server_management_studioMatch18.0

[
  {
    "product": "SQL Server Management Studio 17.9",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "SQL Server Management Studio 17.9"
      }
    ]
  },
  {
    "product": "SQL Server Management Studio 18.0",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "(Preview 4)"
      }
    ]
  }
]

Source	Link
securitytracker	www.securitytracker.com/id/1041826
securityfocus	www.securityfocus.com/bid/105475
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8532
exploit-db	www.exploit-db.com/exploits/45587/

Parameter	Position	Path	Description	CWE
%file%	path	127.0.0.1:8000/payload.dtd	XML External Entity Injection via external entity in XMLA file processed by SSMS leading to local file disclosure.	CWE-611
send	path	127.0.0.1:8000/payload.dtd	XML External Entity Injection via external entity in XMLA file processed by SSMS leading to local file disclosure.	CWE-611

17 Jun 2026 02:05Current

5.2Medium risk

Vulners AI Score5.2

CVSS 24.3

CVSS 35.5

EPSS0.23373

CWE-611