Knowage
CVE-2022-39295
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4.22, 8.0.9, and 8.1.0 is vulnerable to cross-site scripting because the XSSRequestWrapper::stripXSS method can be bypassed. Versions 7.4.22, 8.0.9, and 8.1.0 contain patches for this issue. There are no known workarounds.
AnalysisAI
Knowage is an open source suite for modern business analytics alternative over big data systems. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4.22, 8.0.9, and 8.1.0 is vulnerable to cross-site scripting because the XSSRequestWrapper::stripXSS method can be bypassed. Versions 7.4.22, 8.0.9, and 8.1.0 contain patches for this issue. There are no known workarounds. Affected products include: Eng Knowage.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application. Rated cr
Knowage is an open source analytics and business intelligence suite. Rated high severity (CVSS 8.8), this vulnerability
A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver componen
In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source cr
Knowage is an open source suite for business analytics. Rated medium severity (CVSS 6.5), this vulnerability is remotely
Knowage is the professional open source suite for modern business analytics over traditional sources and big data system
Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). Rated medium severity (CVSS 6.1
Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerabili
In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page. Rated medium sev
Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' vi
Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerabili
Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerabili
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today