CVE-2020-22987

MediumCVSS 6.1

Published: 12/05/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.39%

69th percentile - higher than 69% of all known CVEs

Summary

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the fileToUpload parameter in the uploadFile task.

Risk Assessment

The risk involves executing malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or sensitive data leakage.

Recommendation

Immediately upgrade MicroStrategy Web SDK to version 10.12 or later, which includes a fix for the XSS vulnerability.

Original NVD description (English source)

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the fileToUpload parameter to the uploadFile task.