Description (CNA)
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Microsoft / Microsoft SQL Server | affected 2012 for 32-bit Systems Service Pack 4 (QFE); affected 2012 for x64-based Systems Service Pack 4 (QFE); affected 2016 for x64-based Systems Service Pack 2 (CU) |
| Microsoft / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) | affected unspecified |
| Microsoft / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) | affected unspecified |
| Microsoft / Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) | affected unspecified |
| Microsoft / Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR) | affected unspecified |
| Microsoft / Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU) | affected unspecified |
CWE
No CWE identifiers supplied.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618
- http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html
- http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html
ADP enrichment
No English description supplied.
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618
- http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html
- http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html
No English description supplied.