PatchTheCVECVE-2020-11450: Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other informa
CVE-2020-11450 is a high-severity flaw (CVSS 7.5) affecting microstrategy web. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp. An attacker could use this vulnerability to learn more about the environment the application is running in. This issue has been mitigated in all versions of the product 11.0 and higher.
Why this priority
- High severity
- EPSS top 3%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 20.2% (top 3%) |
| CISA exploited list | No |
| Published | 2020-04-02 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: MicroStrategy Web 10.4 - Information Disclosure
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-11450?
microstrategy web: upgrade to 11.0. Exact commands for each OS are on this page.
Is CVE-2020-11450 being exploited?
CVE-2020-11450 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-11450 affect?
CVE-2020-11450 affects microstrategy web. Severity is high (CVSS 7.5). Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp. An attacker could use this vulnerability to learn more about the environment
How urgent is CVE-2020-11450?
Priority 61/100. High severity; EPSS top 3%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2020-22983 HIGH 8.1 UPGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows re
- CVE-2020-11454 MEDIUM 5.4 DOWNGRADE Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the windo
- CVE-2020-11453 MEDIUM 5.3 DOWNGRADE Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality expo
- CVE-2020-11452 MEDIUM 4.3 UPGRADE Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources s
- CVE-2020-11451 HIGH 7.2 UPGRADE The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a