PT-2019-4537 · Microsoft · Sql Server Reporting Services+1

Mal · CVE-2019-1332 · Publicado 2019-10-12 · Atualizado 2023-02-01

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server Reporting Services (affected versions not specified)

Description A cross-site scripting (XSS) issue exists due to improper sanitization of specially-crafted web requests. This could allow an attacker to run scripts in the context of the targeted user, potentially reading unauthorized content, executing malicious code, and using the victim's identity to take actions on the site.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2020-00577

CVE-2019-1332

Produtos afetados

Sql Server Reporting Services

Sql Server

Referências · 4

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-1332-Cross-Site%20Scripting-Microsoft%20SQL%20Server%20Reporting%20Services · Exploit
• https://bdu.fstec.ru/vul/2020-00577 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1332 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1332 · Aviso do Fabricante