HIGH🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2020-0618

CVSS 8.8v3.1pub. 2020-02-11upd. 2026-08-15

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Microsoft SQL Server

    APP
    Microsoft
    201220142016

CISA KEV — detailsi

Vendori
Microsoft ↗
Producti
SQL Server
Added to KEVi
September 18, 2024
Remediation deadline (US Federal)i
October 9, 2024(overdue)
Ransomwarei
Active ransomware campaigns exploit this vulnerability
Required action (CISA)i

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
☠️WYKORZYSTYWANE W RANSOMWARE⏰CISA DEADLINE: 9 października 2024
Tags
RCEDeserialization
CWE
References

Related vulnerabilities

CVE-2018-8273CRITICAL9.8PL ✓same product

Buffer overflow umożliwiający RCE w Microsoft SQL Server

CVE-2019-1068HIGH8.8⚠ KEVsame product

A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of...

CVE-2012-1856HIGH8.8⚠ KEVsame product

The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 ...

CVE-2024-0056HIGH8.7same product

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

CVE-2023-36417HIGH7.8same product

Microsoft SQL OLE DB Remote Code Execution Vulnerability