Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2018-18696: MicroStrategy Analytics allows forged web requests
CVE-2018-18696 · published 7 years ago
Summary
The web page main.aspx in MicroStrategy Analytics versions 10.4.0026.0049 and earlier can be tricked into performing actions on behalf of a logged‑in user without their consent. This could let an attacker cause unintended changes or data exposure if a user visits a malicious site. Apply the vendor’s recommended configuration steps to require a unique token for each request, or upgrade to a version where this protection is enabled by default.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microstrategy | microstrategy |
<= 10.4.0026.0049 cpe:2.3:a:microstrategy:microstrategy:*:*:*:*:*:*:*:* |
Original advisory text
main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF attack has been provided (https://community.microstrategy....
main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF attack has been provided (https://community.microstrategy.com/s/article/KB37643-New-security-feature-introduced-in-MicroStrategy-Web-9-0?language=en_US) and disagrees that this issue is a vulnerability. They also claim that MicroStrategy was never properly informed of this issue via normal support channels or their vulnerability reporting page on their website, so they were unable to evaluate the report or explain how this is something their customers view as a feature and not a security vulnerability
References
- https://community.microstrategy.com/s/article/KB37643-New-security-feature-intro... Mitigation Vendor Advisory
- https://raw.githubusercontent.com/Siros96/MicroStrategy_CSRF/master/PoC Exploit Third Party Advisory
- https://seclists.org/bugtraq/2018/Dec/3 Exploit Mailing List Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published28 Dec 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-18696 · NVD
Track software like this
Free during beta