PatchTheCVEmicrostrategy web vulnerabilities and fixes
Recent CVEs affecting microstrategy web, with upgrade or downgrade steps. 11 tracked.
Also searched as: microstrategyweb.
microstrategy web has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2022-05-13. Highest priority: CVE-2020-11450 (score 61/100).
- CVE-2020-22983 HIGH 8.1 UPGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows re
- CVE-2020-11454 MEDIUM 5.4 DOWNGRADE Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the windo
- CVE-2020-11453 MEDIUM 5.3 DOWNGRADE Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality expo
- CVE-2020-11452 MEDIUM 4.3 UPGRADE Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources s
- CVE-2020-11451 HIGH 7.2 UPGRADE The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a
- CVE-2020-11450 HIGH 7.5 UPGRADE Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other informa
- CVE-2019-12475 MEDIUM 6.1 UPGRADE In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.
- CVE-2019-12453 MEDIUM 6.1 UPGRADE In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input v
- CVE-2018-18777 MEDIUM 4.3 DOWNGRADE Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the para
- CVE-2018-18776 MEDIUM 6.1 DOWNGRADE Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site S
- CVE-2018-18775 MEDIUM 6.1 DOWNGRADE Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site S
FAQ
How do I fix microstrategy web vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is microstrategy web being exploited right now?
None of the tracked microstrategy web CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which microstrategy web CVE should I patch first?
CVE-2020-11450 currently ranks highest (61/100): Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other informa.