Knowage
CVE-2019-13190
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
1DescriptionNVD
In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page.
AnalysisAI
In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page. Affected products include: Eng Knowage. Version information: through 6.1.1.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.
In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application. Rated cr
Knowage is an open source analytics and business intelligence suite. Rated high severity (CVSS 8.8), this vulnerability
A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver componen
In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source cr
Knowage is an open source suite for business analytics. Rated medium severity (CVSS 6.5), this vulnerability is remotely
Knowage is the professional open source suite for modern business analytics over traditional sources and big data system
Knowage is an open source suite for modern business analytics alternative over big data systems. Rated medium severity (
Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). Rated medium severity (CVSS 6.1
Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerabili
In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page. Rated medium sev
Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' vi
Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerabili
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today