PT-2019-4537 · Microsoft · Sql Server Reporting Services+1

Mal · Published 2019-10-12 · Updated 2023-02-01 · CVE-2019-1332

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server Reporting Services (affected versions not specified)

Description A cross-site scripting (XSS) issue exists due to improper sanitization of specially-crafted web requests. This could allow an attacker to run scripts in the context of the targeted user, potentially reading unauthorized content, executing malicious code, and using the victim's identity to take actions on the site.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-00577

CVE-2019-1332

Affected Products

Sql Server Reporting Services

Sql Server

References · 4

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-1332-Cross-Site%20Scripting-Microsoft%20SQL%20Server%20Reporting%20Services · Exploit
• https://bdu.fstec.ru/vul/2020-00577 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1332 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1332 · Vendor Advisory