Vulnerability · Published Jun 23, 2023 · Assigned by GitHub_M
CVE-2023-35154Knowage-Server vulnerable to account validation bypass
High 7.2
In plain English
A high-severity improper authentication in Knowage-Server from KnowageLabs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.4%top 67.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activate their account without having to click on the link included in the email, allowing them access to the application as a normal user. This issue has been patched in version 8.1.8.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| KnowageLabs | Knowage-Server | < 8.1.8 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N