What is the CVSS score of CVE-2020-1044?

CVE-2020-1044 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 1.9%.

Is there a patch available for CVE-2020-1044?

Yes, a patch is available for CVE-2020-1044. Update the affected software to the latest version immediately.

Sql Server Reporting Services CVE-2020-1044

MEDIUM

Improper Input Validation (CWE-20)

2020-09-11 secure@microsoft.com

Authentication Bypass Sql Server Reporting Services

4.3

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Sep 11, 2020 - 17:15 cve.org

MEDIUM 4.3

DescriptionCVE.org

A security feature bypass vulnerability exists in SQL Server Reporting Services (SSRS) when the server improperly validates attachments uploaded to reports. An attacker who successfully exploited this vulnerability could upload file types that were disallowed by an administrator. To exploit the vulnerability, an authenticated attacker would need to send a specially crafted request to an affected SSRS server. The update addresses the vulnerability by modifying how SSRS validates attachment uploads.

AnalysisAI

A security feature bypass vulnerability exists in SQL Server Reporting Services (SSRS) when the server improperly validates attachments uploaded to reports. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-20. A security feature bypass vulnerability exists in SQL Server Reporting Services (SSRS) when the server improperly validates attachments uploaded to reports. An attacker who successfully exploited this vulnerability could upload file types that were disallowed by an administrator. To exploit the vulnerability, an authenticated attacker would need to send a specially crafted request to an affected SSRS server. The update addresses the vulnerability by modifying how SSRS validates attachment uploads. Affected products include: Microsoft Sql Server Reporting Services.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.