CVE-2016-7251

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2016

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via an unspecified parameter in the MDS API. This could enable an attacker to inject a client-side script into the user's instance of Internet Explorer, potentially spoofing content, disclosing information, or taking actions on behalf of the targeted user.

Recommendations For Microsoft SQL Server 2016, as a temporary workaround, consider restricting access to the MDS API until a patch is available. Avoid using unspecified parameters in the MDS API to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.