7.5high
CVE-2017-8516
Microsoft SQL Server Analysis Services in Microsoft SQL Server 2012, Microsoft SQL Server 2014, and Microsoft SQL Server 2016 allows an inf…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
8.3%
percentile 95%
Public exploits
0
none known
Summary
Microsoft SQL Server Analysis Services in Microsoft SQL Server 2012, Microsoft SQL Server 2014, and Microsoft SQL Server 2016 allows an information disclosure vulnerability when it improperly enforces permissions, aka "Microsoft SQL Server Analysis Services Information Disclosure Vulnerability".
Exploit prediction (EPSS)
8.26% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Microsoft Corporation SQL Server
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- Technology feeds
- Microsoft SQL Server (RSS, critical only)
References
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2017-8516 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1039110 · vdb-entry, x_refsource_SECTRACK, x_transferred
- securityfocus.com /bid/100041 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-8516
- NVD: CVE-2017-8516
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.