« Volver al listado

CVE-2017-8516

Estado: ModificadaAlta (7.5)—

Microsoft SQL Server Analysis Services in Microsoft SQL Server 2012, Microsoft SQL Server 2014, and Microsoft SQL Server 2016 allows an information disclosure vulnerability when it improperly enforces permissions, aka "Microsoft SQL Server Analysis Services Information Disclosure Vulnerability".

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microsoft — SQL Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-8516",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft Corporation",
          "product": "SQL Server",
          "versions": [
            {
              "status": "affected",
              "version": "Microsoft SQL Server 2012, Microsoft SQL Server 2014, and Microsoft SQL Server 2016"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-08-08T21:29:00.563",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/100041",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1039110",
      "tags": [
        "URL Repurposed"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8516",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/100041",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1039110",
      "tags": [
        "URL Repurposed"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8516",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft SQL Server Analysis Services in Microsoft SQL Server 2012, Microsoft SQL Server 2014, and Microsoft SQL Server 2016 allows an information disclosure vulnerability when it improperly enforces permissions, aka \"Microsoft SQL Server Analysis Services Information Disclosure Vulnerability\"."
    },
    {
      "lang": "es",
      "value": "Microsoft SQL Server Analysis Services en Microsoft SQL Server 2012, Microsoft SQL Server 2014, y Microsoft SQL Server 2016 permite una vulnerabilidad de divulgación de información cuando aplica permisos de forma incorrecta. Esta vulnerabilidad también es denominada \"Microsoft SQL Server Analysis Services Information Disclosure Vulnerability\"."
    }
  ],
  "lastModified": "2026-06-17T01:26:30.233",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2012:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6CEA6995-0B2D-44C5-9A14-76C9796A9863"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2014:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5A0AA01-39E8-42A5-8B57-46BEE3A2CD51"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2014:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58837806-386A-40AC-B8D3-35765113D75C"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2016:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40058AB9-EE59-449E-B4C4-541E12A4861F"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:sql_server:2016:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51143C5C-46EA-4B37-8C1F-0697A62AC4E8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}