CVE-2020-22985

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the key parameter to the getESRIExtraConfig task.

Score

CVSS 3.1 6.1 Medium

Status

Modified - cve@mitre.org

Published

2022-05-12

Last modified

2026-07-09

Weaknesses

CWE-79

Affected products

• Microstrategy Web Sdk (Microstrategy)

References

• http://www.yourcompany.com:8080/MicroStrategy/servlet/taskProc
• https://medium.com/@win3zz/simple-story-of-some-complicated-xss-on-facebook-8a9c0d80969d
• https://www.microstrategy.com/us/report-a-security-vulnerability
• https://medium.com/%40win3zz/simple-story-of-some-complicated-xss-on-facebook-8a9c0d80969d