CVE-2020-24815 Server-side request forgery in n/a
Authenticated users can exploit SSRF in PDF generation to access internal network resources or leak local files via embedded HTML containers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-24815?
CVE-2020-24815 is a medium-severity server-side request forgery vulnerability in n/a, published on 24 Nov 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access the content of internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. NOTE: 10.4., no fix will be released as version will reach end-of-life on 31/12/2020.
Weakness: CWE-918
Which versions are affected by CVE-2020-24815?
It affects 1 product.
Products include Microstrategy Microstrategy.
How do I fix CVE-2020-24815?
No fix has been published for CVE-2020-24815 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-24815 being exploited?
There is no known exploitation of CVE-2020-24815 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-73jg-p8q6-m47j.