Lucene search

GitHub_MCVELIST:CVE-2023-36819

HistoryJul 03, 2023 - 6:21 p.m.

CVE-2023-36819 Knowage-Server vulnerable to Path traversal in download functionalities

2023-07-0318:21:35

CWE-22

GitHub_M

www.cve.org

cve-2023-36819

knowage-server

path traversal

download

vulnerability

configuration file

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

23.1%

JSON

Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint _/knowage/restful-services/dossier/importTemplateFile_ allows authenticated users to download template hosted on the server. However, starting in the 6.x.x branch and prior to version 8.1.8, the application does not sanitize the _templateName_ parameter allowing an attacker to use *../* in it, and escaping the directory the template are normally placed and download any file from the system. This vulnerability allows a low privileged attacker to exfiltrate sensitive configuration file. This issue has been patched in Knowage version 8.1.8.

CNA Affected

[
  {
    "vendor": "KnowageLabs",
    "product": "Knowage-Server",
    "versions": [
      {
        "version": "< 8.1.8",
        "status": "affected"
      }
    ]
  }
]

References

github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-jw99-hxxj-75g2

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

23.1%

JSON

Related for CVELIST:CVE-2023-36819