Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-12453: MicroStrategy Web can execute hidden scripts via FLTB

CVE-2019-12453 · published 7 years ago

Summary

The web interface of MicroStrategy Web (versions before 10.1 patch 10) does not properly check the FLTB field, allowing a malicious user to inject script code that runs in another user's browser. This could let an attacker steal data or perform actions on behalf of the victim. Apply the latest patches from MicroStrategy or upgrade to a version that includes the fix.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microstrategy	microstrategy_web	<= 10.1 `cpe:2.3:a:microstrategy:microstrategy_web::::::::`

Original advisory text

In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation.

References

http://www.microstrategy.com/producthelp/10.10/Readme/content/web.htm Product
https://github.com/undefinedmode/CVE-2019-12453 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published19 Jul 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-12453 · NVD

Track software like this

Free during beta