Cross site scripting

2022-10-1323:15:00

PRIOn knowledge base

www.prio-n.com

knowage

open source

business analytics

xss

vulnerability

patch

nvd

0.001 Low

EPSS

Percentile

30.0%

JSON

Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4.22, 8.0.9, and 8.1.0 is vulnerable to cross-site scripting because the XSSRequestWrapper::stripXSS method can be bypassed. Versions 7.4.22, 8.0.9, and 8.1.0 contain patches for this issue. There are no known workarounds.

CPENameOperatorVersion
knowagege8.0.0
knowagelt8.0.9
knowagege6.1.0
knowagelt7.4.22

Name	Operator	Version
knowage	ge	8.0.0
knowage	lt	8.0.9
knowage	ge	6.1.0
knowage	lt	7.4.22

References

github.com/KnowageLabs/Knowage-Server/blob/b079a654c1708f82f6914c55be6715ad621d9edd/knowageutils/src/main/java/it/eng/spagobi/utilities/filters/XSSRequestWrapper.java

github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-f2gr-6h9j-rwcw

0.001 Low

EPSS

Percentile

30.0%

JSON

Related for PRION:CVE-2022-39295