microstrategy_web 漏洞

高危2023/10/20

MicroStrategy tinyurl - Server-Side Request Forgery (Blind)

Blind server-side (SSRF) request forgery vulnerability on MicroStrategy URL shortener.

CVSS—

高危CVE-2020-114502020/04/02

MicroStrategy Web 10.4 - Information Disclosure

MicroStrategy Web 10.4 is susceptible to information disclosure. The JVM configuration, CPU architecture, installation folder, and other information are exposed through /MicroStrategyWS/happyaxis.jsp. An attacker can use this vulnerability to learn more about the application environment and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

microstrategy_webPoC 已收录

CVSS7.5EPSS 87.5%

中危CVE-2018-187772018/11/01

Microstrategy Web 7 - Local File Inclusion

Microstrategy Web 7 is vulnerable to local file inclusion via "/WebMstr7/servlet/mstrWeb" (in the parameter subpage). Remote authenticated users can bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application. NOTE: this is a deprecated product.

microstrategy_webPoC 已收录

CVSS4.3EPSS 69.5%

中危CVE-2018-187752018/11/01

Microstrategy Web 7 - Cross-Site Scripting

Microstrategy Web 7 does not sufficiently encode user-controlled inputs, resulting in cross-site scripting via the Login.asp Msg parameter.

microstrategy_webPoC 已收录

CVSS6.1EPSS 20.3%

microstrategy_web

关联漏洞

MicroStrategy tinyurl - Server-Side Request Forgery (Blind)

MicroStrategy Web 10.4 - Information Disclosure

Microstrategy Web 7 - Local File Inclusion

Microstrategy Web 7 - Cross-Site Scripting