CVE-2020-11451 File upload in n/a
Administrators can upload malicious ZIP archives with arbitrary files, potentially leading to code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11451?
CVE-2020-11451 is a high-severity vulnerability in n/a, published on 2 Apr 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files with arbitrary extensions and data. (This is also exploitable via SSRF). Note: The ability to upload visualization plugins requires administrator privileges.
Weakness: CWE-434
Which versions are affected by CVE-2020-11451?
It affects 1 product.
Products include Microstrategy Microstrategy Web.
How do I fix CVE-2020-11451?
No fix has been published for CVE-2020-11451 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-11451 being exploited?
There is no known exploitation of CVE-2020-11451 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7qxm-3wq8-gv2r.