CVE-2018-8533

🗓️ 10 Oct 2018 13:00:00Reported by microsoftType

cve🔗 web.nvd.nist.gov👁 125 Views🌐 WEB

"Microsoft SQL Server Management Studio (SSMS) XML parsing vulnerability

Reporter	Title	Published	Views	Family All 23
zdt	Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection Vulnerability	11 Oct 201800:00	–	zdt
ATTACKERKB	CVE-2018-8532	10 Oct 201813:29	–	attackerkb
ATTACKERKB	CVE-2018-8533	10 Oct 201813:29	–	attackerkb
ATTACKERKB	CVE-2018-8527	10 Oct 201813:29	–	attackerkb
BDU FSTEC	The vulnerability of Microsoft SQL Server Management Studio’s database management tool lies in the insufficient restriction on XML references to external objects, which allows attackers to exploit this to disclose sensitive information.	9 Nov 201800:00	–	bdu_fstec
Circl	CVE-2018-8533	11 Oct 201800:00	–	circl
CNVD	Microsoft SQL Server Management Studio Information Disclosure Vulnerability	10 Oct 201800:00	–	cnvd
Check Point Advisories	Microsoft SQL Server Management Studio XXE Injection Information Disclosure (CVE-2018-8527; CVE-2018-8532; CVE-2018-8533)	18 Nov 201800:00	–	checkpoint_advisories
Cvelist	CVE-2018-8533	10 Oct 201813:00	–	cvelist
Exploit DB	Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection	11 Oct 201800:00	–	exploitdb

NVD

Node

microsoft sql_server_management_studioMatch17.9

microsoft sql_server_management_studioMatch18.0

[
  {
    "product": "SQL Server Management Studio 17.9",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "SQL Server Management Studio 17.9"
      }
    ]
  },
  {
    "product": "SQL Server Management Studio 18.0",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "(Preview 4)"
      }
    ]
  }
]

Source	Link
securitytracker	www.securitytracker.com/id/1041826
securityfocus	www.securityfocus.com/bid/105476
exploit-db	www.exploit-db.com/exploits/45583/
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8533

Parameter	Position	Path	Description	CWE
XML External Entity	nested	/payload.dtd	XML External Entity Injection vulnerability in SSMS via REGSRVR file; POC uses external entity to load payload from attacker-controlled server (payload.dtd).	CWE-611
DOCTYPE injection	nested	/payload.dtd	XML External Entity Injection vulnerability in SSMS via REGSRVR file; POC uses external entity to load payload from attacker-controlled server (payload.dtd).	CWE-611
%file%	nested	/payload.dtd	XML External Entity Injection vulnerability in SSMS via REGSRVR file; POC uses external entity to load payload from attacker-controlled server (payload.dtd).	CWE-611
send	nested	/payload.dtd	XML External Entity Injection vulnerability in SSMS via REGSRVR file; POC uses external entity to load payload from attacker-controlled server (payload.dtd).	CWE-611

17 Jun 2026 02:05Current

5.2Medium risk

Vulners AI Score5.2

CVSS 24.3

CVSS 35.5

EPSS0.23373

CWE-611