Description
Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Microsoft SQL Server | Microsoft / Microsoft SQL Server | 2012 for 32-bit Systems Service Pack 4 (QFE) | affected |
| Microsoft SQL Server | Microsoft / Microsoft SQL Server | 2012 for x64-based Systems Service Pack 4 (QFE) | affected |
| Microsoft SQL Server | Microsoft / Microsoft SQL Server | 2016 for x64-based Systems Service Pack 2 (CU) | affected |
| Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU) | Microsoft / Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU) | unspecified | affected |
| Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR) | Microsoft / Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR) | unspecified | affected |
| Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) | Microsoft / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) | unspecified | affected |
| Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) | Microsoft / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) | unspecified | affected |
| Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) | Microsoft / Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) | unspecified | affected |