Cross-site scripting (XSS) vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "MDS API XSS Vulnerability."

The remote Microsoft SQL Server is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - Multiple elevation of privilege vulnerabilities exist     in the SQL RDBMS Engine due to improper handling of     pointer casting. An authenticated, remote attacker can     exploit these to gain elevated privileges.
    (CVE-2016-7249, CVE-2016-7250, CVE-2016-7254)

  - A cross-site scripting (XSS) vulnerability exists in     the SQL server MDS API due to improper validation of a     request parameter on the SQL server site. An     unauthenticated, remote attacker can exploit this, via     a specially crafted request, to execute arbitrary code     in the user's browser session. (CVE-2016-7251)

  - An information disclosure vulnerability exists in     Microsoft SQL Analysis Services due to improper     validation of the FILESTREAM path. An authenticated,     remote attacker can exploit this to disclose sensitive     database and file information. (CVE-2016-7252)

  - An elevation of privilege vulnerability exists in the     Microsoft SQL Server Engine due to improper checking by     the SQL Server Agent of ACLs on atxcore.dll. An     authenticated, remote attacker can exploit this to gain     elevated privileges. (CVE-2016-7253)

The remote host is running a version of Microsoft SQL Server 2016 13.0.1605.0 through 13.0.1721.0 and is affected by multiple vulnerabilities :

 - A flaw exists in the RDBMS engine that is triggered during the handling of pointer casting. This may allow an authenticated attacker to gain elevated privileges. (CVE-2016-7249, CVE-2016-7250)
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the MDS API does not validate input before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2016-7251)
 - A flaw exists in the Analysis services that is triggered as FILESTREAM paths are not properly checked. This may allow an authenticated attacker to gain access to sensitive information. (CVE-2016-7252)

ID	Name	Product	Family	Severity
122484	MS16-136: Security Update for SQL Server (3199641) (uncredentialed check)	Nessus	Windows	high
9814	Microsoft SQL Server 2016 13.0.1605.0 through 13.0.1721.0 Multiple Privilege Escalation (3194716)	Nessus Network Monitor	Database	medium
94637	MS16-136: Security Update for SQL Server (3199641)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2016-7251

medium

Tenable Plugins

high

medium

high