Knowage-suite

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Knowage-suite records in CISA KEV

No Knowage-suite vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

4 records in Knowage · all components

TI-2018-08855 CVE-2018-12354 · GHSA-7736-7gm2-mw57

LOW 38

Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.0046 Published 2018-06-13 No fix listed CWE-352

TI-2018-08854 CVE-2018-12353 · GHSA-85xx-4qwh-vc8g

LOW 28

Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00647 Published 2018-06-13 No fix listed CWE-79

TI-2019-10633 CVE-2019-14278 · GHSA-pmr3-v68q-5p68

LOW 26

In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01152 Published 2019-09-05 No fix listed

TI-2019-10030 CVE-2019-13349 · GHSA-qcjg-47f3-cgjr

LOW 25

In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.01315 Published 2019-09-05 No fix listed CWE-522