Vulnerability Details CVE-2020-11450
Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp. An attacker could use this vulnerability to learn more about the environment the application is running in. This issue has been mitigated in all versions of the product 11.0 and higher.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.875
EPSS Ranking 99.4%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html
- http://seclists.org/fulldisclosure/2020/Apr/1
- https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability
- https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/
- http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html
- http://seclists.org/fulldisclosure/2020/Apr/1
- https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability
- https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/
Products affected by CVE-2020-11450
-
cpe:2.3:a:microstrategy:microstrategy_web:-
-
cpe:2.3:a:microstrategy:microstrategy_web:10.1
-
cpe:2.3:a:microstrategy:microstrategy_web:10.4
-
cpe:2.3:a:microstrategy:microstrategy_web:10.4.6
-
cpe:2.3:a:microstrategy:microstrategy_web:7