Availability of proof-of-concept (PoC) code for recently disclosed remote code execution flaw in Microsoft SQL Server Reporting Services leaves sites vulnerable to attack.

CVE-2020-0618: Proof of Concept for Microsoft SQL Server Reporting Services Vulnerability Available

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability :

  - A remote code execution vulnerability exists in     Microsoft SQL Server Reporting Services when it     incorrectly handles page requests. An attacker who     successfully exploited this vulnerability could execute     code in the context of the Report Server service     account.  (CVE-2020-0618)

ID	Name	Product	Family	Type	Severity
133719	Security Updates for Microsoft SQL Server (February 2020)	Nessus	Windows : Microsoft Bulletins	Local	high
133718	Security Updates for Microsoft SQL Server (Uncredentialed Check) (February 2020)	Nessus	Windows	Remote	high

Detections

Analytics

CVE-2020-0618

high

Tenable Plugins

high

high