Unscored severity · published Oct 9, 2012
CVE-2012-2552
Cross-site scripting (XSS) vulnerability in the SQL Server Report Manager in Microsoft SQL Server 2000 Reporting Services SP2 and SQL Server 2005 SP4, 2008 SP2 and SP3, 2008 R2…
–
CVSS
16.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the SQL Server Report Manager in Microsoft SQL Server 2000 Reporting Services SP2 and SQL Server 2005 SP4, 2008 SP2 and SP3, 2008 R2 SP1, and 2012 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "Reflected XSS Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)16.3% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Sql Server · Microsoft
2005; 2005; 2005; 2005; 2008; 2008; +9 more · source: NVD
SS
Sql Server Reporting Services · Microsoft
2000 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2552
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2552
www.securityfocus.com
http://www.securityfocus.com/bid/55783
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA12-283A.html
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-070
oval.cisecurity.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15395
More from Sql Server
8.8
CVE-2020-0618
Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability
8.8
CVE-2019-1068
Microsoft SQL Server Remote Code Execution Vulnerability
8.8
CVE-2012-1856
Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability
9.8
CVE-2018-8273
A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected system, aka "Microsoft SQL Server Remote Code Execution…
8.8
CVE-2023-38169
Microsoft SQL OLE DB Remote Code Execution Vulnerability