CVE-2019-13349

概要

参考情報

• blog.contentsecurity.com.au/knowage-password-hash-disclosure · Exploit

knowage のその他の脆弱性

• CVE-2019-14278中 5.3In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.
• CVE-2018-12354高 8.8Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST requ…
• CVE-2018-12353中 6.1Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.