PatchTheCVEmicrostrategy vulnerabilities
Recent CVEs affecting microstrategy products. 20 tracked.
microstrategy has 20 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 13. Most recent: 2022-05-13. Highest priority: CVE-2022-29596 (score 65/100).
- CVE-2020-24815 MEDIUM 6.5 DOWNGRADE A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6,
- CVE-2020-22987 MEDIUM 6.1 UPGRADE Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthentic
- CVE-2020-22986 MEDIUM 6.1 UPGRADE Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthentic
- CVE-2020-22985 MEDIUM 6.1 UPGRADE Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthentic
- CVE-2020-22984 MEDIUM 6.1 UPGRADE Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthentic
- CVE-2020-22983 HIGH 8.1 UPGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows re
- CVE-2022-29596 CRITICAL 9.8 DOWNGRADE MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then ente
- CVE-2020-11454 MEDIUM 5.4 DOWNGRADE Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the windo
- CVE-2020-11453 MEDIUM 5.3 DOWNGRADE Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality expo
- CVE-2020-11452 MEDIUM 4.3 UPGRADE Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources s
- CVE-2020-11451 HIGH 7.2 UPGRADE The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a
- CVE-2020-11450 HIGH 7.5 UPGRADE Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other informa
- CVE-2019-18957 MEDIUM 6.1 UPGRADE Microstrategy Library in MicroStrategy before 2019 before 11.1.3 has reflected XSS.
- CVE-2019-12475 MEDIUM 6.1 UPGRADE In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.
- CVE-2019-12453 MEDIUM 6.1 UPGRADE In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input v
- CVE-2018-6885 CRITICAL 9.8 UPGRADE An issue was discovered in MicroStrategy Web Services (the Microsoft Office plugin) before 10.4 Hotfix 7, and
- CVE-2018-18777 MEDIUM 4.3 DOWNGRADE Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the para
- CVE-2018-18776 MEDIUM 6.1 DOWNGRADE Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site S
- CVE-2018-18775 MEDIUM 6.1 DOWNGRADE Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site S
- CVE-2018-18696 HIGH 8.8 UPGRADE main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF
FAQ
How do I fix microstrategy vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is microstrategy being exploited right now?
None of the tracked microstrategy CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which microstrategy CVE should I patch first?
CVE-2022-29596 currently ranks highest (65/100): MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then ente.