CVE-2020-11450

EPSS 17.8%

Vexday Risk Score

23Bajo

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 17.8%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

02 abr 2020Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp. An attacker could use this vulnerability to learn more about the environment the application is running in. This issue has been mitigated in all versions of the product 11.0 and higher.

Productos afectados

n/a · n/a

Referencias

http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability http://seclists.org/fulldisclosure/2020/Apr/1 https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/