CVE-2020-22987
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the fileToUpload parameter in the uploadFile task.
Risk Assessment
The risk involves executing malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or sensitive data leakage.
Recommendation
Immediately upgrade MicroStrategy Web SDK to version 10.12 or later, which includes a fix for the XSS vulnerability.
Other vulnerabilities in MicroStrategy Web SDK
See all- CVE-2020-22983High
An SSRF vulnerability in MicroStrategy Web SDK 11.1 and earlier allows unauthenticated remote attackers to perform server-side request forgery via the srcURL parameter in the shortURL task.
- CVE-2020-22986Medium
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK version 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the searchString parameter in the wikiScrapper task.
- CVE-2020-22985Medium
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary code via the 'key' parameter in the getESRIExtraConfig task.
- CVE-2020-22984Medium
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary JavaScript code via the 'key' parameter in the getGoogleExtraConfig task.
Original NVD description (English source)
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the fileToUpload parameter to the uploadFile task.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS