{"id":"CVE-2020-24815","aliases":["EUVD-2020-17524","GHSA-73jg-p8q6-m47j"],"status":"published","title":"A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019...","description":"A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access the content of internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. NOTE: 10.4., no fix will be released as version will reach end-of-life on 31/12/2020.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01836,"percentile":0.7922,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-918"],"published":"2020-11-24T16:48:58Z","modified":"2026-07-09T00:17:00Z","exploits":[{"source":"pocgithub","id":"darkvirus-7x/exploit-CVE-2020-24815","title":"darkvirus-7x/exploit-CVE-2020-24815","date":"2023-03-18","url":"https://github.com/darkvirus-7x/exploit-CVE-2020-24815"}],"products":[{"vendor":"microstrategy","product":"microstrategy"}],"references":[{"url":"https://triskelelabs.com/extracting-your-aws-access-keys-through-a-pdf-file/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://community.microstrategy.com/s/article/Securing-PDF-and-Excel-Export-with-Whitelists?language=en_US","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24815"},{"url":"http://microstrategy.com"},{"url":"https://triskelelabs.com/extracting-your-aws-access-keys-through-a-pdf-file"},{"url":"https://github.com/advisories/GHSA-73jg-p8q6-m47j"}],"sources":{"cve":[{"id":"CVE-2020-24815","description":"A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access the content of internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. NOTE: 10.4., no fix will be released as version will reach end-of-life on 31/12/2020.","status":"published","published":"2020-11-24T16:48:58Z","modified":"2026-07-09T00:11:00.839Z","updated_at":"2026-11-02T14:35:54.468882Z"}],"euvd":[{"id":"EUVD-2020-17524","description":"A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access the content of internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. NOTE: 10.4., no fix will be released as version will reach end-of-life on 31/12/2020.","status":"published","published":"2020-11-24T16:48:58Z","modified":"2026-07-09T00:11:00Z","updated_at":"2026-11-02T18:20:09.583461Z"}],"ghsa":[{"id":"GHSA-73jg-p8q6-m47j","title":"A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019...","description":"A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access the content of internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. NOTE: 10.4., no fix will be released as version will reach end-of-life on 31/12/2020.","status":"published","published":"2022-05-24T17:34:52Z","modified":"2026-07-05T00:31:16Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:09:14.376377Z"}],"nvd":[{"id":"CVE-2020-24815","description":"A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access the content of internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. NOTE: 10.4., no fix will be released as version will reach end-of-life on 31/12/2020.","status":"published","published":"2020-11-24T17:15:10.957Z","modified":"2026-07-09T00:17:00.847Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:06:25.394006Z"}]}}