Back to Database
Status published
High
CVE-2020-11451
The Upload Visualization plugin in the Microstrategy Web 10.4 admin...
Vulnerability Description
The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files with arbitrary extensions and data. (This is also exploitable via SSRF). Note: The ability to upload visualization plugins requires administrator privileges.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-11451
Credits & Attribution
No credits recorded in the NVD database.
References
- https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability
- https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/
- http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html
- http://seclists.org/fulldisclosure/2020/Apr/1
More from microstrategy
View All →CVE-2022-29596
MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a...
Critical
9.8
CVE-2020-24815
A Server-Side Request Forgery (SSRF) affecting the PDF generation in...
Medium
6.5
CVE-2020-22987
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and...
Medium
6.1
CVE-2020-22986
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and...
Medium
6.1
CVE-2020-22985
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and...
Medium
6.1
Affected Vendor
microstrategy
View all reports →Affected Software
microstrategy web
Vulnerable Versions:
0
Timeline
Official Publish:
April 2nd, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.