CVE-2020-22984
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary JavaScript code via the 'key' parameter in the getGoogleExtraConfig task.
Risk Assessment
An attacker can inject malicious scripts, leading to session hijacking, account takeover, or leakage of sensitive data within the organization.
Recommendation
Immediately upgrade MicroStrategy Web SDK to a version later than 10.11 that includes a fix for this XSS vulnerability.
Other vulnerabilities in MicroStrategy Web SDK
See all- CVE-2020-22983High
An SSRF vulnerability in MicroStrategy Web SDK 11.1 and earlier allows unauthenticated remote attackers to perform server-side request forgery via the srcURL parameter in the shortURL task.
- CVE-2020-22987Medium
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the fileToUpload parameter in the uploadFile task.
- CVE-2020-22986Medium
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK version 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the searchString parameter in the wikiScrapper task.
- CVE-2020-22985Medium
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary code via the 'key' parameter in the getESRIExtraConfig task.
Original NVD description (English source)
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via key parameter to the getGoogleExtraConfig task.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS