PT-2025-17416 · Knowbe4 · Knowbe4 Security Awareness Training

Published 2025-04-20 · Updated 2025-05-13 · CVE-2020-36845

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KnowBe4 Security Awareness Training versions prior to 2020-01-10

Description The issue concerns a redirect function in the application that fails to validate the destination URL before redirecting. This allows the response to contain a SCRIPT element that sets window.location.href to an arbitrary https URL.

Recommendations For versions prior to 2020-01-10, consider disabling the redirect function until a fix is applied to prevent potential exploitation. Restrict access to the redirect functionality to minimize risk. Avoid using the window.location.href variable in the affected redirect function until the issue is resolved.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-36845

Affected Products

Knowbe4 Security Awareness Training

References · 8

• 🔥 https://doyler.net/security-not-included/knowbe4-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2020-36845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36845 · Security Note
• https://t.me/cvenotify/119098 · Telegram Post
• https://t.me/cvetracker/22029 · Telegram Post
• https://t.me/cvenotify/121935 · Telegram Post
• https://t.me/cvedetector/23419 · Telegram Post
• https://twitter.com/CVEnew/status/1914080166332285230 · Twitter Post