Gravedad: High
  Identificadores de CVE : CVE-2012-2552
  Fecha recomendada: 24 de octubre de 2012

  Descripción

This patch addresses a vulnerability existing in Microsoft SQL Server on systems with SQL Server Reporting Services (SSRS). It is a cross-site scripting vulnerability that could allow attackers to execute arbitrary commands on the SSRS site. A remote attacker can exploit this vulnerability by sending a specially crafted link to the users. Moreover, attackers can host a web page that can exploit this vulnerability.

  Soluciones

  Software y versión afectados

  • Microsoft SQL Server 2008 R2 for x64-based Systems Service Pack 1
  • Microsoft SQL Server 2008 R2 for Itanium-based Systems Service Pack 1
  • Microsoft SQL Server 2012 for x64-based Systems
  • Microsoft SQL Server 2005 Express Edition with Advanced Services Service Pack 4
  • Microsoft SQL Server 2005 for 32-bit Systems Service Pack 4
  • Microsoft SQL Server 2005 for x64-based Systems Service Pack 4
  • Microsoft SQL Server 2005 for Itanium-based Systems Service Pack 4
  • Microsoft SQL Server 2008 for 32-bit Systems Service Pack 2
  • Microsoft SQL Server 2008 for 32-bit Systems Service Pack 3
  • Microsoft SQL Server 2008 for x64-based Systems Service Pack 2
  • Microsoft SQL Server 2008 for x64-based Systems Service Pack 3
  • Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 2
  • Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 3
  • Microsoft SQL Server 2008 R2 for 32-bit Systems Service Pack 1
  • Microsoft SQL Server 2012 for 32-bit Systems