CVE-2018-8527

CVE Database · CVE-2018-8527

CVE-2018-8527

· N/AModified

CVSS v3.1

N/A

EPSS

23.37%

Published

Oct 10, 2018

Modified

Nov 21, 2024

Public PoC / Exploit (2)

All weaponized →

Exploit-DBMicrosoft SQL Server Management Studio 17.9 - '.xel' XML External Entity Injection TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server Management Studio 17.9, SQL Server Management Studio 18.0. This CVE ID is unique from CVE-2018-8532, CVE-2018-8533.

Weaknesses (CWE)

CWE-611

Affected Products (2)

microsoft · sql_server_management_studiovulnerable

References (8)

http://www.securityfocus.com/bid/105474

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1041826

Third Party AdvisoryVDB Entry

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8527

PatchVendor Advisory

https://www.exploit-db.com/exploits/45585/

ExploitThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/105474

Third Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs