Vulnerability · Published Sep 11, 2020 · Assigned by microsoft
CVE-2020-1044SQL Server Reporting Services Security Feature Bypass Vulnerability
Medium 4.3
In plain English
A medium-severity security flaw in SQL Server 2017 Reporting Services from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 80% of all known vulnerabilities).
Official description
<p>A security feature bypass vulnerability exists in SQL Server Reporting Services (SSRS) when the server improperly validates attachments uploaded to reports. An attacker who successfully exploited this vulnerability could upload file types that were disallowed by an administrator.</p> <p>To exploit the vulnerability, an authenticated attacker would need to send a specially crafted request to an affected SSRS server.</p> <p>The update addresses the vulnerability by modifying how SSRS validates attachment uploads.</p>
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | SQL Server 2017 Reporting Services | 14.0.0 – before publication |
| Microsoft | SQL Server 2019 Reporting Services | 15.0.0 – before publication |