An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containi…

Published 8 y ago 2018-10-10 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

23.4%

percentile 98%

Public exploits

Exploit-DB

An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server Management Studio 17.9, SQL Server Management Studio 18.0. This CVE ID is unique from CVE-2018-8527, CVE-2018-8533.

Exploit prediction (EPSS)

23.37% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

EDB-45587 Microsoft SQL Server Management Studio 17.9 - '.xmla' XML External Entity Injection · local · 2018-10-11

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	5.5	`CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:P/I:N/A:N`

Affected products

Microsoft SQL Server Management Studio 17.9
Microsoft SQL Server Management Studio 18.0

Classification

Weakness

CWE-611 Improper Restriction of XML External Entity Reference

References

portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2018-8532 · x_refsource_CONFIRM, x_transferred
securitytracker.com /id/1041826 · vdb-entry, x_refsource_SECTRACK, x_transferred
securityfocus.com /bid/105475 · vdb-entry, x_refsource_BID, x_transferred
exploit-db.com /exploits/45587/ · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

CVE List: CVE-2018-8532
NVD: CVE-2018-8532

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary