CVE-2020-22983
HighCVSS 8.1Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
An SSRF vulnerability in MicroStrategy Web SDK 11.1 and earlier allows unauthenticated remote attackers to perform server-side request forgery via the srcURL parameter in the shortURL task.
Risk Assessment
Attackers can use the server to scan internal networks, access sensitive resources, or launch attacks on other systems, potentially leading to data leakage or infrastructure compromise.
Recommendation
Immediately upgrade MicroStrategy Web SDK to a version later than 11.1 and implement validation and filtering of the srcURL parameter in the shortURL task.
Other vulnerabilities in MicroStrategy Web SDK
See all- CVE-2020-22987Medium
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the fileToUpload parameter in the uploadFile task.
- CVE-2020-22986Medium
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK version 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the searchString parameter in the wikiScrapper task.
- CVE-2020-22985Medium
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary code via the 'key' parameter in the getESRIExtraConfig task.
- CVE-2020-22984Medium
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary JavaScript code via the 'key' parameter in the getGoogleExtraConfig task.
Original NVD description (English source)
A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a server-side request forgery (SSRF) attack via the srcURL parameter to the shortURL task.