Approved changes feed: RSS · Atom
cpe:2.3:a:eng:knowage:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Eng (3bdb9698-bded-556e-a599-37a3bc18393b) |
|---|---|
| Product | Knowage (e69ca5f1-9852-5763-bc84-0ad914a4a1e7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/knowagelabs/knowage-server |
purl2cpe | 2026-06-01 10:17:16.545523 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-59954 |
vulnerable | 2026-06-08 07:35:23.512386 |
Knowage Contains a Remote Code Execution Vulnerability
Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe org.apache.commons.jxpath.JXPathContext in MetaService.java service. This issue is fixed in version 8.1.27.
Published: 2025-09-29T23:48:04.968Z
Updated: 2025-09-30T14:18:08.836Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-58441 |
vulnerable | 2026-06-08 07:35:18.281888 |
Knowage is vulnerable to blind server-side request forgery (SSRF)
Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response, the impact of this vulnerability is limited. However, an attacker should be able to leverage this vulnerability to scan the internal network. This issue has been patched in version 8.1.37.
Published: 2026-01-07T17:16:44.798Z
Updated: 2026-01-07T18:21:35.951Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-55007 |
vulnerable | 2026-06-08 07:33:13.960530 |
Knowage vulnerable to server-side request forgery
LOW (3.5)
Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request forgery. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response, the impact of this vulnerability is limited. However, an attacker could be able to leverage this vulnerability to scan the internal network. This issue has been patched in version 8.1.37.
Published: 2025-09-01T15:46:04.915Z
Updated: 2025-09-02T18:15:03.646Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-57971 |
vulnerable | 2026-06-08 06:56:14.059314 |
Details available
CRITICAL (9.1)
DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name.
Published: 2025-02-16T00:00:00.000Z
Updated: 2025-03-21T13:48:38.429Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-38702 |
vulnerable | 2026-06-08 06:08:18.663134 |
Knowage Server vulnerable to path traversal via upload functionality
CRITICAL (10)
Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-services/dossier/importTemplateFile` allows authenticated users to upload `template file` on the server, but does not need any authorization to be reached. When the JSP file is uploaded, the attacker just needs to connect to `/knowageqbeengine/foo.jsp` to gain code execution on the server. By exploiting this vulnerability, an attacker with low privileges can upload a JSP file to the `knowageqbeengine` directory and gain code execution capability on the server. This issue has been patched in Knowage version 8.1.8.
Published: 2023-08-04T18:10:28.899Z
Updated: 2024-10-08T17:39:16.743Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-37472 |
vulnerable | 2026-06-08 06:08:15.401081 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-36819 |
vulnerable | 2026-06-08 06:08:13.545163 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-35154 |
vulnerable | 2026-06-08 06:06:26.660396 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-39295 |
vulnerable | 2026-06-08 05:47:18.550502 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-30058 |
vulnerable | 2026-06-08 05:31:46.830519 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-30057 |
vulnerable | 2026-06-08 05:31:46.830050 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-30056 |
vulnerable | 2026-06-08 05:31:46.829556 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-30055 |
vulnerable | 2026-06-08 05:31:46.829056 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-13348 |
vulnerable | 2026-06-08 05:12:42.153760 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-13190 |
vulnerable | 2026-06-08 05:12:41.390020 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-13189 |
vulnerable | 2026-06-08 05:12:41.389728 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-13188 |
vulnerable | 2026-06-08 05:12:41.389350 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.