Vulnerability Details : CVE-2020-11451
Potential exploit
The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files with arbitrary extensions and data. (This is also exploitable via SSRF). Note: The ability to upload visualization plugins requires administrator privileges.
Vulnerability category: Server-side request forgery (SSRF)
Products affected by CVE-2020-11451
- cpe:2.3:a:microstrategy:microstrategy_web:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-11451
4.03%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 87 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-11451
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
|
7.2
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
1.2
|
5.9
|
NIST |
CWE ids for CVE-2020-11451
-
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-11451
-
http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html
MicroStrategy Intelligence Server And Web 10.4 XSS / Disclosure / SSRF / Code Execution ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability
KB439880: Web Services Security VulnerabilityPatch;Vendor Advisory
-
http://seclists.org/fulldisclosure/2020/Apr/1
Full Disclosure: MicroStrategy Intelligence Server and Web 10.4 - multiple vulnerabilities
-
https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/
Another SSRF, Another RCE - The Microstrategy case - Red Timmy SecurityExploit;Third Party Advisory
Jump to