CVE-2020-11453

Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality requires no authentication and, while it is not possible to pass parameters in the SSRF request, it is still possible to exploit it to conduct port scanning. An attacker could exploit this vulnerability to enumerate the resources allocated in the network (IP addresses and services exposed). NOTE: MicroStrategy is unable to reproduce the issue reported in any version of its product

• CWE-918

• http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Apr/1
• https://community.microstrategy.com/s/article/Web-Services-Security-VulnerabilityPatch, Vendor Advisory
• https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Apr/1
• https://community.microstrategy.com/s/article/Web-Services-Security-VulnerabilityPatch, Vendor Advisory
• https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/Exploit, Third Party Advisory

Published

Apr 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11448An issue was discovered on Bell HomeHub 3000 SG48222070 devi…6.1
• CVE-2020-11449An issue was discovered on Technicolor TC7337 8.89.17 device…7.5
• CVE-2020-1145An information disclosure vulnerability exists in the way th…5.5
• CVE-2020-11450Microstrategy Web 10.4 exposes the JVM configuration, CPU ar…7.5
• CVE-2020-11451The Upload Visualization plugin in the Microstrategy Web 10.…7.2
• CVE-2020-11452Microstrategy Web 10.4 includes functionality to allow users…4.3
• CVE-2020-11454Microstrategy Web 10.4 is vulnerable to Stored XSS in the HT…5.4
• CVE-2020-11455LimeSurvey before 4.1.12+200324 contains a path traversal vu…9.8
• CVE-2020-11456LimeSurvey before 4.1.12+200324 has stored XSS in applicatio…5.4
• CVE-2020-11457pfSense before 2.4.5 has stored XSS in system_usermanager_ad…5.4
• CVE-2020-11458app/Model/feed.php in MISP before 2.4.124 allows administrat…4.9
• CVE-2020-1146<p>An elevation of privilege vulnerability exists when the M…6.6