Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Knowage-suite records in CISA KEVNo Knowage-suite vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority LOW 38
Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.0046 · Published 2018-06-13 · No fix listed CWE-352
Priority LOW 28
Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00647 · Published 2018-06-13 · No fix listed CWE-79
Priority LOW 26
In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01152 · Published 2019-09-05 · No fix listed
Priority LOW 25
In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.
CVSS 3.0MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01315 · Published 2019-09-05 · No fix listed CWE-522
