7.5

CVE-2020-11450

Exploit

EPSS 91.2%
Veröffentlicht 02.04.2020 15:15:17
Zuletzt bearbeitet 21.11.2024 04:57:56
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp. An attacker could use this vulnerability to learn more about the environment the application is running in. This issue has been mitigated in all versions of the product 11.0 and higher.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 0 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Microstrategy ≫ Microstrategy Web Version < 11.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	91.2%	0.996

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

Es wurden noch keine Informationen zu CWE veröffentlicht.

https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability

Patch

Vendor Advisory

http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html

Third Party Advisory

Exploit

VDB Entry

http://seclists.org/fulldisclosure/2020/Apr/1

Third Party Advisory

Mailing List

https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2020-11450

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-11450

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-11450

EUVD