CVE-2020-22984

MediumCVSS 6.1

Published: 12/05/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.51%

71th percentile - higher than 71% of all known CVEs

Summary

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary JavaScript code via the 'key' parameter in the getGoogleExtraConfig task.

Risk Assessment

An attacker can inject malicious scripts, leading to session hijacking, account takeover, or leakage of sensitive data within the organization.

Recommendation

Immediately upgrade MicroStrategy Web SDK to a version later than 10.11 that includes a fix for this XSS vulnerability.

Original NVD description (English source)

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via key parameter to the getGoogleExtraConfig task.