CVE-2020-11452

Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under attacker control, it's possible to send requests to external resources (aka SSRF) or leak files from the local system using the file:// stream wrapper.

• CWE-918

• http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Apr/1
• https://community.microstrategy.com/s/article/Web-Services-Security-VulnerabilityPatch, Vendor Advisory
• https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Apr/1
• https://community.microstrategy.com/s/article/Web-Services-Security-VulnerabilityPatch, Vendor Advisory
• https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/Exploit, Third Party Advisory

Published

Apr 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11447An issue was discovered on Bell HomeHub 3000 SG48222070 devi…4.3
• CVE-2020-11448An issue was discovered on Bell HomeHub 3000 SG48222070 devi…6.1
• CVE-2020-11449An issue was discovered on Technicolor TC7337 8.89.17 device…7.5
• CVE-2020-1145An information disclosure vulnerability exists in the way th…5.5
• CVE-2020-11450Microstrategy Web 10.4 exposes the JVM configuration, CPU ar…7.5
• CVE-2020-11451The Upload Visualization plugin in the Microstrategy Web 10.…7.2
• CVE-2020-11453Microstrategy Web 10.4 is vulnerable to Server-Side Request …5.3
• CVE-2020-11454Microstrategy Web 10.4 is vulnerable to Stored XSS in the HT…5.4
• CVE-2020-11455LimeSurvey before 4.1.12+200324 contains a path traversal vu…9.8
• CVE-2020-11456LimeSurvey before 4.1.12+200324 has stored XSS in applicatio…5.4
• CVE-2020-11457pfSense before 2.4.5 has stored XSS in system_usermanager_ad…5.4
• CVE-2020-11458app/Model/feed.php in MISP before 2.4.124 allows administrat…4.9