CVE-2020-22986

MediumCVSS 6.1

Published: 12/05/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.48%

71th percentile - higher than 71% of all known CVEs

Summary

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK version 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the searchString parameter in the wikiScrapper task.

Risk Assessment

The risk involves executing malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or sensitive data leakage.

Recommendation

Immediately update MicroStrategy Web SDK to a version later than 10.11 where this vulnerability is fixed.

Original NVD description (English source)

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the searchString parameter to the wikiScrapper task.