CVE-2020-11450

EPSS 17.8%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 17.8%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

02 Apr 2020Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp. An attacker could use this vulnerability to learn more about the environment the application is running in. This issue has been mitigated in all versions of the product 11.0 and higher.

Affected products

n/a · n/a

References

http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability http://seclists.org/fulldisclosure/2020/Apr/1 https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/