AI description
CVE-2020-0618 is a remote code execution vulnerability found in Microsoft SQL Server Reporting Services (SSRS). This flaw arises from an insecure deserialization issue within SSRS, specifically concerning how it processes ViewState data in page requests. Attackers can exploit this by crafting and injecting malicious serialized objects into the ViewState, which, upon deserialization by the server, leads to the execution of arbitrary code. The vulnerability requires an authenticated attacker, meaning valid credentials are necessary to access the SSRS web interface. Once authenticated, even with low-privilege access, an attacker can send a specially formatted HTTP request containing the malicious payload to achieve code execution on the affected SQL Server system. This vulnerability has been actively exploited in the wild and affects various versions of Microsoft SQL Server.
- Description
- A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
- Source
- secure@microsoft.com
- NVD status
- Analyzed
- Products
- sql_server
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 6.5
- Impact score
- 6.4
- Exploitability score
- 8
- Vector string
- AV:N/AC:L/Au:S/C:P/I:P/A:P
Data from CISA
- Vulnerability name
- Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability
- Exploit added on
- Sep 18, 2024
- Exploit action due
- Oct 9, 2024
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:sql_server:2012:sp4:*:*:*:*:*:*",
"matchCriteriaId": "D7BD8F6C-FD88-483F-95E8-16F7A6BCFCC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:*:*",
"matchCriteriaId": "03C65D96-44D0-4411-8B84-961973F1E4D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:2016:sp2:*:*:*:*:x64:*",
"matchCriteriaId": "CDCE78A8-26F9-4F9E-BDDD-E59DEA4A3791",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]