9.8
Critical
Exploited
· ransomware
CVE-2020-0618 Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Known to be used
Weakness
CWE-502
Description
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft SQL Server | Versions not published | |
| Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) | Versions not published | |
| Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) | Versions not published | |
| Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) | Versions not published | |
| Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR) | Versions not published | |
| Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU) | Versions not published |
References
- portal.msrc.microsoft.com portal.msrc.microsoft.com
- packetstormsecurity.com packetstormsecurity.com
- packetstormsecurity.com packetstormsecurity.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified