CVE-2025-55007

Knowage vulnerable to server-side request forgery

State: Published
Severity: 3.5 Low
Published: Sep 1, 2025
Updated: Sep 2, 2025
Reserved: Aug 4, 2025

Description

Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request forgery. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response, the impact of this vulnerability is limited. However, an attacker could be able to leverage this vulnerability to scan the internal network. This issue has been patched in version 8.1.37.

Scores

CVSS	Score	Vector	Source
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
Knowage-ServerKnowageLabs	< 8.1.37Affected

References

https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-7f6m-ph57-52w6

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.