CVE-2023-35154 Knowage-Server vulnerable to account validation bypass
Attackers can bypass email verification to register and access the Knowage analytics application as a normal user.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-35154?
CVE-2023-35154 is a high-severity authentication bypass vulnerability in KnowageLabs Knowage-Server, published on 23 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activate their account without having to click on the link included in the email, allowing them access to the application as a normal user. This issue has been patched in version 8.1.8.
Weakness: CWE-287
Which versions are affected by CVE-2023-35154?
It affects 1 product.
Products include Eng Knowage.
How do I fix CVE-2023-35154?
No fix has been published for CVE-2023-35154 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-35154 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-35154 exists.
Other vulnerabilities in KnowageLabs Knowage-Server
Sources
Also known as GHSA-48hp-jvv8-cf62.