What is CVE-2018-6885?

CVE-2018-6885 is a critical-severity vulnerability in Microstrategy Web Services, classified under Path Traversal. CVSS score: 9.8/10. Published 2019-05-14.

How severe is CVE-2018-6885?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Path Traversal in Microstrategy Web Services

CVE-2018-6885

An issue was discovered in MicroStrategy Web Services (the Microsoft Office plugin) before 10.4 Hotfix 7, and before 10.11. The vulnerability is unauthenticated and leads to access to the asset files with the MicroStrategy user privileges. (This includes the credentials to access the admin dashboard which may lead to RCE.) The path traversal is located in a SOAP request in the web service component.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.014 (70.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Microstrategy Web_services — versions 10.4
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-6885?: CVE-2018-6885 is a critical-severity vulnerability in Microstrategy Web Services, classified under Path Traversal. CVSS score: 9.8/10. Published 2019-05-14.
How severe is CVE-2018-6885?: Critical severity. CVSS v3 base score is 9.8 out of 10.