CVE-2023-36819

🗓️ 03 Jul 2023 18:21:35Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 34 Views🌐 WEB

Knowage 6.x.x-8.1.8 allows directory traversal to exfiltrate sensitive files

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2023-36819	3 Jul 202322:22	–	circl
CNNVD	Knowage 路径遍历漏洞	3 Jul 202300:00	–	cnnvd
Cvelist	CVE-2023-36819 Knowage-Server vulnerable to Path traversal in download functionalities	3 Jul 202318:21	–	cvelist
EUVD	EUVD-2023-40749	3 Oct 202520:07	–	euvd
NVD	CVE-2023-36819	3 Jul 202319:15	–	nvd
OSV	CVE-2023-36819 Knowage-Server vulnerable to Path traversal in download functionalities	3 Jul 202318:21	–	osv
Prion	Design/Logic Flaw	3 Jul 202319:15	–	prion
RedhatCVE	CVE-2023-36819	23 May 202504:02	–	redhatcve
Vulnrichment	CVE-2023-36819 Knowage-Server vulnerable to Path traversal in download functionalities	3 Jul 202318:21	–	vulnrichment

NVD

Vulners

Node

eng knowageRange6.0.0–8.1.8

[
  {
    "vendor": "KnowageLabs",
    "product": "Knowage-Server",
    "versions": [
      {
        "version": "< 8.1.8",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-jw99-hxxj-75g2

Parameter	Position	Path	Description	CWE
_templateName_	query param	knowage/restful-services/dossier/importTemplateFile	Endpoint vulnerable to path traversal via unsanitized _templateName_ parameter allowing file exfiltration.	CWE-22

21 Nov 2024 08:10Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.16.5

EPSS0.00176

SSVC

CWE-22