CVE-2022-39295

Improper Neutralization of Alternate XSS Syntax in Knowage-Server

State: Published
Severity: 6.1 Medium
Published: Oct 13, 2022
Updated: Apr 22, 2025
Reserved: Sep 2, 2022

Description

Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4.22, 8.0.9, and 8.1.0 is vulnerable to cross-site scripting because the `XSSRequestWrapper::stripXSS` method can be bypassed. Versions 7.4.22, 8.0.9, and 8.1.0 contain patches for this issue. There are no known workarounds.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-87 Improper Neutralization of Alternate XSS Syntax
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Knowage-ServerKnowageLabs	>= 6.0, < 7.4.22Affected >= 8.0, < 8.0.9Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.