CVE-2018-18696

HIGH 8.8CVE-2018-18696 · Published 28/12/2018 · updated 17/06/2026

In short

CVE-2018-18696 is a HIGH (CVSS 8.8) vulnerability affecting microstrategy (microstrategy).
Chance of exploitation in the next 30 days (EPSS): 0.85%, higher than 58.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
microstrategy microstrategy	`≤ 10.4.0026.0049`	No fix yet

Description

main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF attack has been provided (https://community.microstrategy.com/s/article/KB37643-New-security-feature-introduced-in-MicroStrategy-Web-9-0?language=en_US) and disagrees that this issue is a vulnerability. They also claim that MicroStrategy was never properly informed of this issue via normal support channels or their vulnerability reporting page on their website, so they were unable to evaluate the report or explain how this is something their customers view as a feature and not a security vulnerability

References

community.microstrategy.com/s/article/KB37643-New-security-feature-introduced-in-MicroStrategy-Web-9-0 · Mitigation
raw.githubusercontent.com/Siros96/MicroStrategy_CSRF/master/PoC · Exploit
seclists.org/bugtraq/2018/Dec/3 · Exploit

More vulnerabilities in microstrategy

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

microstrategy

≤ 10.4.0026.0049

No fix yet

Description