CVE-2018-18696: main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF attack has ...

Description

main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF attack has been provided (https://community.microstrategy.com/s/article/KB37643-New-security-feature-introduced-in-MicroStrategy-Web-9-0?language=en_US) and disagrees that this issue is a vulnerability. They also claim that MicroStrategy was never properly informed of this issue via normal support channels or their vulnerability reporting page on their website, so they were unable to evaluate the report or explain how this is something their customers view as a feature and not a security vulnerability

Metrics

EPSS Probability

0.85%

53.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-352

Affected Software

Vendor	Product	Versions
Microstrategy	Microstrategy	<= 10.4.0026.0049

References

https://community.microstrategy.com/s/article/KB37643-New-security-feature-introduced-in-MicroStrategy-Web-9-0?language=en_USMitigation, Vendor Advisory
https://raw.githubusercontent.com/Siros96/MicroStrategy_CSRF/master/PoCExploit, Third Party Advisory
https://seclists.org/bugtraq/2018/Dec/3Exploit, Mailing List, Third Party Advisory
https://community.microstrategy.com/s/article/KB37643-New-security-feature-introduced-in-MicroStrategy-Web-9-0?language=en_USMitigation, Vendor Advisory
https://raw.githubusercontent.com/Siros96/MicroStrategy_CSRF/master/PoCExploit, Third Party Advisory
https://seclists.org/bugtraq/2018/Dec/3Exploit, Mailing List, Third Party Advisory

Timeline

Published: Dec 28, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-18696?

main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF attack has been provided (https://community.microstrategy.com/s/article/KB37643-New-security-feature-introduced-in-MicroStrategy-Web-9-0?language=en_US) and disagrees that this issue is a vulnerability. They also claim that MicroStrategy was never properly informed of this issue via normal support channels or their vulnerability reporting page on their website, so they were unable to evaluate the report or explain how this is something their customers view as a feature and not a security vulnerability

How severe is CVE-2018-18696?

Severity scoring for CVE-2018-18696 is pending analysis. The EPSS model estimates a 0.85% probability of exploitation in the next 30 days.

How do I fix CVE-2018-18696?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2018

View all 2018CVEs →