NVD Vulnerability Detail

CVE-2020-11453

Summary	Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality requires no authentication and, while it is not possible to pass parameters in the SSRF request, it is still possible to exploit it to conduct port scanning. An attacker could exploit this vulnerability to enumerate the resources allocated in the network (IP addresses and services exposed). NOTE: MicroStrategy is unable to reproduce the issue reported in any version of its product
Publication Date	April 3, 2020, 1:15 a.m.
Registration Date	Jan. 26, 2021, 11:51 a.m.
Last Update	Nov. 21, 2024, 1:57 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:microstrategy:microstrategy_web:10.4:::::::*

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html	Exploit Third Party Advisory VDB Entry
2	http://seclists.org/fulldisclosure/2020/Apr/1
3	https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability	Patch Vendor Advisory
4	https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/	Exploit Third Party Advisory
5	http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html	Exploit Third Party Advisory VDB Entry
6	https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/	Exploit Third Party Advisory
7	https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability	Patch Vendor Advisory
8	http://seclists.org/fulldisclosure/2020/Apr/1

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-918	サーバサイドリクエストフォージェリ	https://cwe.mitre.org/data/definitions/918.html

JVN Vulnerability Information

Microstrategy Web におけるサーバサイドのリクエストフォージェリの脆弱性

Title	Microstrategy Web におけるサーバサイドのリクエストフォージェリの脆弱性
Summary	Microstrategy Web には、サーバサイドのリクエストフォージェリの脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 2, 2020, midnight
Registration Date	April 21, 2020, 5:42 p.m.
Last Update	April 21, 2020, 5:42 p.m.

Affected System

マイクロストラテジー・ジャパン株式会社

Microstrategy Web 10.4

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-11453	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11453
National Vulnerability Database (NVD)
2	CVE-2020-11453	https://nvd.nist.gov/vuln/detail/CVE-2020-11453

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-918	https://cwe.mitre.org/data/definitions/918.html

ベンダー情報

No	Name	URL
Knowledge
1	KB439880	https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability?language=en_US

その他

No	Name	URL
関連文書
1	MicroStrategy Intelligence Server And Web 10.4 XSS / Disclosure / SSRF / Code Execution	https://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html

Change Log

No	Changed Details	Date of change
1	[2020年04月21日] 掲載	April 21, 2020, 5:42 p.m.