Lucene search

[email protected]CVE-2019-12475

HistoryJul 17, 2019 - 5:15 p.m.

CVE-2019-12475

2019-07-1717:15:13

CWE-79

[email protected]

web.nvd.nist.gov

cve

2019

12475

microstrategy

web

xss

metric

input validation

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

36.3%

JSON

In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.

Affected configurations

NVD

Node

microstrategymicrostrategy_webRange<10.4.6

CPENameOperatorVersion
microstrategy:microstrategy_webmicrostrategy microstrategy weblt10.4.6

CPE	Name	Operator	Version
microstrategy:microstrategy_web	microstrategy microstrategy web	lt	10.4.6

References

community.microstrategy.com/s/article/Defects-and-Enhancements-Addressed-in-MicroStrategy-10-4-6-Secure-Enterprise-Platform?language=en_US

github.com/undefinedmode/CVE-2019-12475

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

36.3%

JSON

Related for CVE-2019-12475

prion1 cvelist1 nvd1 githubexploit1