Snapshot of public data from 31 Oct 2026, 12:50:06. This data is not updated until the API is deployed.

TACTICThreat Analysis & Cyber Threat Intelligence Center
System themeFrançais

Back to the watch

CVE-2020-0618

Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability

UrgentCVSS 9.8 v3.1Exploited

Why this priority

?

Generic watch priority computed by public, versioned rules. It does not know your assets. See the glossary

  • Présent dans le catalogue CISA KEV (exploitation confirmée)

Description

Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.

Affected products

VendorProductVersions
MicrosoftMicrosoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)
  • unspecified
MicrosoftMicrosoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)
  • unspecified
MicrosoftMicrosoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)
  • unspecified
MicrosoftMicrosoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)
  • unspecified
MicrosoftMicrosoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)
  • unspecified
MicrosoftMicrosoft SQL Server
  • 2012 for 32-bit Systems Service Pack 4 (QFE)
  • 2012 for x64-based Systems Service Pack 4 (QFE)
  • 2016 for x64-based Systems Service Pack 2 (CU)
MicrosoftSQL ServerAll versions

Revision history

  1. Revision 3

  2. Revision 2

    Update : Affected versions changed

  3. Revision 1

    New record

Qualification

CVSS severity
?

Technical severity score between 0 and 10, with its version (3.1, 4.0). See the glossary

9.8 CRITICAL CVSS v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KEV catalog
?

CISA catalog of vulnerabilities with confirmed exploitation. Absence from the catalog does not prove absence of exploitation. See the glossary

Listed
Exploitation
Confirmed
EPSS probability
?

Probability, between 0 and 1, that a vulnerability is exploited in the next 30 days, published daily by FIRST. Always dated. See the glossary

Unknown
Confidence
?

Quality of the sources behind the record. It is not a risk score. See the glossary

High

Priority rules, version 1

CISA KEV catalog

Added on
18 September 2024
Federal due date
9 October 2024
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ransomware use
Known

Record

Published on
11 February 2020
Weaknesses (CWE)
CWE-502

Sources

References

CVE-2020-0618 Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability · Avanguard TACTIC