Read the docs
TI-2023-19080 Aliases CVE-2023-37472

Query injection in Knowage server

Priority HIGH 67CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queries without prior sanitization. An attacker can create specially crafted HQL queries that will break subsequent SQL queries generated by the Hibernate engine. The endpoint `_/knowage/restful-services/2.0/documents/listDocument_` calls the `_countBIObjects_` method of the `_BIObjectDAOHibImpl_` object with the user supplied `_label_` parameter without prior sanitization. This can lead to SQL injection in the backing database. Other injections have been identified in the application as well. An authenticated attacker with low privileges could leverage this vulnerability in order to retrieve sensitive information from the database, such as account credentials or business information. This issue has been addressed in version 8.1.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00706 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Knowage-Server (KnowageLabs): 8.1.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KnowageLabsKnowage-Server6.0.0 to before 8.1.88.1.8Patch availableCNA
  • Knowage-Server VendorKnowageLabs Affected 6.0.0 to before 8.1.8 Fixed in 8.1.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eng:knowage:*:*:*:*:*:*:*:*6.1.0 to before 8.1.8VulnerableKnowageLabs
  • cpe:2.3:a:eng:knowage:*:*:*:*:*:*:*:* Versions 6.1.0 to before 8.1.8 Vulnerable ·KnowageLabs

Remediation

  • Fix · CNA Knowage-Server (KnowageLabs) Fixed in 8.1.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-37472

References

Exploit 1

  • TI-2025-37342 Knowage Contains a Remote Code Execution Vulnerability CVSS 4.0CRITICAL 9.3
  • TI-2023-20050 Knowage Server vulnerable to path traversal via upload functionality CVSS 3.1CRITICAL 10.0
  • TI-2023-17600 Knowage-Server vulnerable to account validation bypass CVSS 3.1HIGH 7.2
  • TI-2023-18613 Knowage-Server vulnerable to Path traversal in download functionalities CVSS 3.1MEDIUM 6.5
  • TI-2022-18671 Improper Neutralization of Alternate XSS Syntax in Knowage-Server CVSS 3.1MEDIUM 6.1
  • TI-2019-09881 In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application. CVSS 3.0CRITICAL 9.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences