CVE-2020-0618criticalunder attackransomwareCWE-502

CVE-2020-0618: critical vulnerability in Microsoft SQL Server

Published · Updated

Follow this CVE+ Monitor Microsoft SQL Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 99%
from disclosure to weapon4 days
Published on NVDFeb 11
1st PoC+4d
metasploitFeb 11
CISA KEV+1681d
Action required by CISAfederal deadline: 2024-10-09

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Microsoft SQL Server Reporting Services has a critical vulnerability that allows attackers to execute malicious code remotely on affected systems. This happens because the service incorrectly processes certain page requests, giving attackers a way to take complete control of the server.

Technical detail

A remote code execution vulnerability in MSSQL Reporting Services stems from improper handling of page requests, enabling unauthenticated attackers to execute arbitrary code with the privileges of the Reporting Services process. The vulnerability is triggered via specially crafted HTTP requests and can lead to full system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Microsoft · Microsoft SQL ServerMicrosoft · Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)Microsoft · Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)Microsoft · Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)Microsoft · Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)Microsoft · Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft SQL Server

In the same product, most dangerous first.

CVE-2019-1068HIGHCVE-2019-1068EPSS 57.3%KEVCVE-2018-8273—CVE-2018-8273EPSS 31.2%