# CVE-2020-0618

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

- Page: https://www.vulneraibility.com/cve/CVE-2020-0618
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2024-09-18; CISA due date 2024-10-09; known ransomware use
- EPSS: 99.05% (percentile 99.9)
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module · 4 GitHub proofs of concept · 1 Nuclei template (first 2020-02-15)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2024-09-20)
- Weakness: CWE-502
- Published: 2020-02-11

## Affected versions

- Microsoft Microsoft SQL Server: affected 2012 for 32-bit Systems Service Pack 4 (QFE); 2012 for x64-based Systems Service Pack 4 (QFE); 2016 for x64-based Systems Service Pack 2 (CU)

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618
- [other] http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html
- [other] http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0618

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.