CVE-2020-11452

Katalog CVE

CVSS 4.3 · Medium EPSS 1,2%

Kerentanan Server-Side Request Forgery (SSRF) pada microstrategy web. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under attacker control, it's possible to send requests to external resources (aka SSRF) or leak files from the local system using the file:// stream wrapper.

Rincian

Terbit di NVD

2 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability patch · advisory vendor
• http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF... exploit · advisory pihak ketiga · vdb entry
• https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/ exploit · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2020/Apr/1