PT-2019-12800 · Microstrategy · Microstrategy Web

Undefinedmode · Published 2019-07-19 · Updated 2019-08-05 · CVE-2019-12453

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MicroStrategy Web versions prior to 10.1 patch 10

Description The issue is related to stored XSS, which is possible due to missing input validation in the FLTB parameter.

Recommendations For versions prior to 10.1 patch 10, update to version 10.1 patch 10 or later to resolve the issue. As a temporary workaround, consider restricting access to the FLTB parameter to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-12453

Affected Products

Microstrategy Web

References · 4

• 🔥 https://github.com/undefinedmode/CVE-2019-12453 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12453 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12453 · Vendor Advisory
• http://microstrategy.com/producthelp/10.10/Readme/content/web.htm · Note