CVE-2018-18776

Name of the Vulnerable Software and Affected Versions Microstrategy Web version 7

Description The issue is related to insufficient encoding of user-controlled inputs, leading to a Cross-Site Scripting (XSS) vulnerability. This can be exploited via the ShowAll parameter in the "admin/admin.asp" endpoint. It is noted that Microstrategy Web is a deprecated product.

Recommendations For version 7, consider restricting access to the ShowAll parameter in the "admin/admin.asp" endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the ShowAll parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.