QwikSec

Security Database

CVE

CWE

Training

CVE-2020-11452

Published: Apr 2, 2020

Modified: Aug 4, 2024

PUBLISHED

Description

Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under attacker control, it's possible to send requests to external resources (aka SSRF) or leak files from the local system using the file:// stream wrapper.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability

x_refsource_MISC

https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/

x_refsource_MISC

http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html

x_refsource_MISC

20200403 MicroStrategy Intelligence Server and Web 10.4 - multiple vulnerabilities

mailing-list

x_refsource_FULLDISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.