CVE-2020-22985

MediumCVSS 6.1

Published: 12/05/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.51%

71th percentile - higher than 71% of all known CVEs

Summary

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary code via the 'key' parameter in the getESRIExtraConfig task.

Risk Assessment

An attacker can inject malicious scripts, leading to session theft, account takeover, or website defacement.

Recommendation

Immediately upgrade MicroStrategy Web SDK to a version later than 10.11 and apply input filtering for the 'key' parameter.

Original NVD description (English source)

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the key parameter to the getESRIExtraConfig task.