CVE-2020-11452 json
Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases.
published 2020-04-02 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-3806
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 68%
- public exploits
- 0
- none known
Summary
Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under attacker control, it's possible to send requests to external resources (aka SSRF) or leak files from the local system using the file:// stream wrapper.
Patch / fix
Exploit prediction
1.21% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- redtimmy.com https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/ referenced PoC, tagged "exploit" by a source, unverified
- packetstormsecurity.com http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
community.microstrategy.com
/s/article/Web-Services-Security-Vulnerability
patch, vendor-advisory
-
redtimmy.com
/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/
exploit, third-party-advisory
-
packetstormsecurity.com
/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html
exploit, third-party-advisory, vdb-entry
-
seclists.org
/fulldisclosure/2020/Apr/1
mailing-list
Sources
- CVE List CVE-2020-11452
- NVD CVE-2020-11452
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.