Medium severity6.1NVD Advisory· Published May 12, 2022· Updated Jun 17, 2026

CVE-2020-22985

Description

Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the key parameter to the getESRIExtraConfig task.

Affected products

MicroStrategy/Web SDKdescription
MicroStrategy/MicroStrategy Webllm-fuzzy
Range: <=10.11

Patches

Vulnerability mechanics

References

www.microstrategy.com/us/report-a-security-vulnerabilitynvdVendor Advisory
microstrategy.comnvdProduct
www.yourcompany.com:8080/MicroStrategy/servlet/taskProcnvdBroken Link
medium.com/%40win3zz/simple-story-of-some-complicated-xss-on-facebook-8a9c0d80969dnvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000