CVEvulnerability
CVE-2020-11452
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-04-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-918
Description
Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under attacker control, it's possible to send requests to external resources (aka SSRF) or leak files from the local system using the file:// stream wrapper.
Affected configurations
• microstrategy microstrategy web (<= 10.4)
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Apr/1 seclists.org
- https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability Patch, Vendor Advisory
- https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/ Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Apr/1 seclists.org
- https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability Patch, Vendor Advisory
- https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/ Exploit, Third Party Advisory