Microstrategy Web CVE-2019-12453

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2019-07-19 cve@mitre.org

XSS Microstrategy Web

6.1

CVSS 3.0 · NVD

Share

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

1

CVE Published

Jul 19, 2019 - 17:15 nvd

MEDIUM 6.1

DescriptionNVD

In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation.

AnalysisAI

In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation. Affected products include: Microstrategy Microstrategy Web. Version information: before 10.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.

More in Microstrategy Web

View all

CVE-2020-11450 HIGH This Week POC

Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information throu

CVE-2020-11451 HIGH This Week POC

The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archiv

CVE-2018-18776 MEDIUM This Month POC

Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (

CVE-2018-18775 MEDIUM This Month POC

Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (

CVE-2020-11454 MEDIUM This Month POC

Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowin

CVE-2020-11453 MEDIUM This Month POC

Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed throug

CVE-2020-22983 HIGH This Week

A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unaut

CVE-2020-11452 MEDIUM This Month POC

Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URL

CVE-2018-18777 MEDIUM This Month POC

Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subp

CVE-2019-12475 MEDIUM This Month

In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation. Rated medium sev

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2013-7389 MEDIUM POC

CVE-2021-25299 MEDIUM POC

CVE-2014-2120 MEDIUM

CVE-2023-40000 HIGH POC

CVE-2016-8581 MEDIUM POC

CVE-2013-5223 MEDIUM POC

CVE-2025-52367 MEDIUM POC

CVE-2015-0072 MEDIUM POC

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

CVE-2013-1710 CRITICAL POC

CVE-2013-7389 MEDIUM POC

CVE-2021-25299 MEDIUM POC

CVE-2014-2120 MEDIUM

CVE-2023-40000 HIGH POC

CVE-2024-52875 HIGH POC

CVE-2016-8581 MEDIUM POC

Share

CVE-2019-12453 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy