Kaspersky LabKLA11888

HistoryOct 09, 2018 - 12:00 a.m.

KLA11888 Multiple vulnerabilties in Microsoft SQL Server

2018-10-0900:00:00

Kaspersky Lab

threats.kaspersky.com

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

5.8 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.3%

JSON

An information disclosure vulnerabilities were found in Microsoft SQL Server. Malicious users can exploit this vulnerability to obtain sensitive information.

Original advisories

CVE-2018-8527

CVE-2018-8532

CVE-2018-8533

Exploitation

Public exploits exist for this vulnerability.

Related products

Microsoft-SQL-Server

CVE list

CVE-2018-8532 high

CVE-2018-8527 high

CVE-2018-8533 high

KB list

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.