Microsoft SQL Server Management Studio 17.9
At a glance
- Source
- NVD
- EPSS
- EPSS 23.37 % · percentile 98 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- microsoft
- NVD status
- Modified
Description
An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server Management Studio 17.9, SQL Server Management Studio 18.0. This CVE ID is unique from CVE-2018-8527, CVE-2018-8533.
Weaknesses (CWE)
- CWE-611 — Improper Restriction of XML External Entity Reference
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 5.5 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2018-20156
- GCVE · GCVE-0-2018-8532
CERT-FR advisories
- CERTFR-2018-AVI-486 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:microsoft:sql_server_management_studio:17.9:*:*:*:*:*:*:*cpe:2.3:a:microsoft:sql_server_management_studio:18.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Microsoft · SQL Server Management Studio 17.9 | affected SQL Server Management Studio 17.9 |
| Microsoft · SQL Server Management Studio 18.0 | affected (Preview 4) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |