CVE-2020-11454

Katalog CVE

CVSS 5.4 · Medium EPSS 0,90%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada microstrategy web. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard. In order to exploit this vulnerability, a user needs to get access to a shared dashboard or have the ability to create a dashboard on the application.

Rincian

Terbit di NVD

2 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,90% peluang dieksploitasi; lebih tinggi dari 58,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability patch · advisory vendor
• http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF... exploit · advisory pihak ketiga · vdb entry
• https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/ exploit · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2020/Apr/1