CVE-2020-22986
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK version 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the searchString parameter in the wikiScrapper task.
Risk Assessment
The risk involves executing malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or sensitive data leakage.
Recommendation
Immediately update MicroStrategy Web SDK to a version later than 10.11 where this vulnerability is fixed.
Other vulnerabilities in MicroStrategy Web SDK
See all- CVE-2020-22983High
An SSRF vulnerability in MicroStrategy Web SDK 11.1 and earlier allows unauthenticated remote attackers to perform server-side request forgery via the srcURL parameter in the shortURL task.
- CVE-2020-22987Medium
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the fileToUpload parameter in the uploadFile task.
- CVE-2020-22985Medium
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary code via the 'key' parameter in the getESRIExtraConfig task.
- CVE-2020-22984Medium
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary JavaScript code via the 'key' parameter in the getGoogleExtraConfig task.
Original NVD description (English source)
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the searchString parameter to the wikiScrapper task.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS