// For flags

CVE-2020-11453

MicroStrategy Intelligence Server And Web 10.4 XSS / Disclosure / SSRF / Code Execution

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality requires no authentication and, while it is not possible to pass parameters in the SSRF request, it is still possible to exploit it to conduct port scanning. An attacker could exploit this vulnerability to enumerate the resources allocated in the network (IP addresses and services exposed). NOTE: MicroStrategy is unable to reproduce the issue reported in any version of its product

**DISPUTA** Microstrategy Web versión 10.4, es vulnerable a un ataque de tipo Server-Side Request Forgery en la funcionalidad Test Web Service expuesta por medio de la ruta /MicroStrategyWS/. La funcionalidad no requiere autenticación y, aunque no es posible pasar parámetros en la petición SSRF, aún es posible explotarla para conducir un escaneo de puertos. Un atacante podría explotar esta vulnerabilidad para enumerar los recursos asignados en la red (direcciones IP y servicios expuestos). NOTA: MicroStrategy no puede reproducir el problema reportado en ninguna versión de su producto

MicroStrategy Intelligence Server and Web version 10.4 suffers from remote code execution, cross site scripting, server-side request forgery, and information disclosure vulnerabilities.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-04-01 CVE Reserved
  • 2020-04-02 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • 2024-08-29 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-918: Server-Side Request Forgery (SSRF)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Microstrategy
Search vendor "Microstrategy"
 Microstrategy Web
Search vendor "Microstrategy" for product "Microstrategy Web"
 10.4
Search vendor "Microstrategy" for product "Microstrategy Web" and version "10.4"
-
Affected