Vulnerabilities

TI-2026-19396 CVE-2026-24069 · GHSA-446f-x529-8hw2

Improper Enforcement of Disabled Accounts in WebUI SSO in Kiuwan SAST

LOW 24

Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00189 Published 2026-04-14 Fixed in 2.8.2509.4 CWE-863

TI-2023-26778 CVE-2023-49113 · GHSA-phxr-ggj2-vch6

Sensitive Data Stored Insecurely in Kiuwan SAST Local Analyzer

LOW 35

The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00178 Published 2024-06-20 No fix listed CWE-312

TI-2023-26777 CVE-2023-49112 · GHSA-m8h7-pff8-m5jq

Insecure Direct Object Reference in Kiuwan SAST

MEDIUM 62

Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the "application" parameter.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00517 Published 2024-06-20 No fix listed CWE-639

TI-2023-26776 CVE-2023-49111 · GHSA-39wq-w29m-4ccv

Reflected Cross-Site-Scripting in Kiuwan SAST

MEDIUM 62

For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html".

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00646 Published 2024-06-20 No fix listed CWE-79

TI-2023-26775 CVE-2023-49110 · GHSA-55gj-hcpf-vg3h

XML External Entity Injection in Kiuwan SAST

HIGH 67

When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application (either on-premises or cloud/SaaS solution), the transmitted data consists of a ZIP archive containing several files, some of the…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0082 Published 2024-06-20 No fix listed CWE-611