Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

When SQL Server Reporting Services is installed on Microsoft SQL
Server, an attacker can generate a Cross Site Scripting, in order
to execute JavaScript code in the context of the web site.

Impacted products: SQL Server

Severity: 2/4

Creation date: 09/10/2012

DESCRIPTION OF THE VULNERABILITY

The SSRS (SQL Server Reporting Services) component can be
installed on Microsoft SQL Server, in order to provide reporting
tools.

However, the SQL Server Report Manager does not correctly validate
its parameters, before displaying them on the web site.

When SQL Server Reporting Services is installed on Microsoft SQL
Server, an attacker can therefore generate a Cross Site Scripting,
in order to execute JavaScript code in the context of the web site.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/Microsoft-SQL-Server-Cross-Site-Scripting-via-SSRS-12049