CVE-2022-39295: medium-severity vulnerability in KnowageLabs Knowage-Server
Improper Neutralization of Alternate XSS Syntax in Knowage-Server
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.7%
Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4.22, 8.0.9, and 8.1.0 is vulnerable to cross-site scripting because the `XSSRequestWrapper::stripXSS` method can be bypassed. Versions 7.4.22, 8.0.9, and 8.1.0 contain patches for this issue. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
KnowageLabs · Knowage-ServerRelated CVEs — KnowageLabs Knowage-Server
In the same product, most dangerous first.
CVE-2023-38702CRITICALKnowage Server vulnerable to path traversal via upload functionalityEPSS 1.2%CVE-2023-36819MEDIUMKnowage-Server vulnerable to Path traversal in download functionalitiesEPSS 0.8%CVE-2023-37472HIGHQuery injection in Knowage serverEPSS 0.7%CVE-2025-59954CRITICALKnowage Contains a Remote Code Execution VulnerabilityEPSS 0.5%CVE-2023-35154HIGHKnowage-Server vulnerable to account validation bypassEPSS 0.4%CVE-2025-55007LOWKnowage vulnerable to server-side request forgeryEPSS 0.2%