Skip to content
OpenAdvisories
Unscored Public exploit CVE-2018-8527 EUVD-2018-20151GHSA-gmwc-6m29-5hv6

An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containin…

Published Oct 10, 2018 · Updated Aug 5, 2024 · Assigned by microsoft

Vendor: Microsoft Product: SQL Server Management Studio 17.9 Product: SQL Server Management Studio 18.0

Description

An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server Management Studio 17.9, SQL Server Management Studio 18.0. This CVE ID is unique from CVE-2018-8532, CVE-2018-8533.

Affected products

VendorProductAffectedFixed
Microsoft SQL Server Management Studio 17.9 SQL Server Management Studio 17.9 —
Microsoft SQL Server Management Studio 18.0 (Preview 4) —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References