CVE-2020-24815
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
An SSRF vulnerability in PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. Version 10.4 will not receive a fix as it reaches end-of-life on 31/12/2020.
Risk Assessment
The risk involves unauthorized access to internal network resources and leakage of sensitive files from the system, potentially leading to data and infrastructure security breaches.
Recommendation
Immediately upgrade MicroStrategy to version 2019 Update 6 or 2020 Update 2. For version 10.4, consider migrating to a supported version before end-of-life.
Original NVD description (English source)
A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access the content of internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. NOTE: 10.4., no fix will be released as version will reach end-of-life on 31/12/2020.