Read the docs
TI-2020-01013 Aliases CVE-2020-1044GHSA-j5c4-63f4-32wp

SQL Server Reporting Services Security Feature Bypass Vulnerability

Priority LOW 33CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

<p>A security feature bypass vulnerability exists in SQL Server Reporting Services (SSRS) when the server improperly validates attachments uploaded to reports. An attacker who successfully exploited this vulnerability could upload file types that were disallowed by an administrator.</p> <p>To exploit the vulnerability, an authenticated attacker would need to send a specially crafted request to an affected SSRS server.</p> <p>The update addresses the vulnerability by modifying how SSRS validates attachment uploads.</p>

Why it matters now

EPSS 0.01961 80th percentileScored 2026-11-07
Fix Fixed SQL Server 2017 Reporting Services (Microsoft): publicationSQL Server 2019 Reporting Services (Microsoft): publication

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftSQL Server 2017 Reporting Services14.0.0 to before publicationpublicationPatch availableCNA
MicrosoftSQL Server 2019 Reporting Services15.0.0 to before publicationpublicationPatch availableCNA
  • SQL Server 2017 Reporting Services VendorMicrosoft Affected 14.0.0 to before publication Fixed in publication Patch available CNA
  • SQL Server 2019 Reporting Services VendorMicrosoft Affected 15.0.0 to before publication Fixed in publication Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:sql_server_reporting_services:2017:*:*:*:*:*:*:*2017VulnerableMicrosoft
cpe:2.3:a:microsoft:sql_server_reporting_services:2019:*:*:*:*:*:*:*2019VulnerableMicrosoft
  • cpe:2.3:a:microsoft:sql_server_reporting_services:2017:*:*:*:*:*:*:* Versions 2017 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:sql_server_reporting_services:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft

Remediation

  • Fix · CNA SQL Server 2017 Reporting Services (Microsoft) Fixed in publication
  • Fix · CNA SQL Server 2019 Reporting Services (Microsoft) Fixed in publication

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1044
  2. 2026-10-03 Alias added: GHSA-j5c4-63f4-32wp

References

Patch 1

  • TI-2008-02885 gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server… CVSS 2.0HIGH 9.3
  • TI-2007-05142 Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3… CVSS 2.0HIGH 9.3
  • TI-2008-02887 Integer overflow in gdiplus.dll in GDI+ in Microsoft Office XP SP3, Office 2003 SP2 and… CVSS 2.0HIGH 9.3
  • TI-2008-02886 Buffer overflow in gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP… CVSS 2.0HIGH 9.3
  • TI-2008-02884 gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server… CVSS 2.0HIGH 9.3
  • TI-2009-02389 Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2… CVSS 2.0HIGH 9.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences