PT-2025-6765 · Unknown · Knowage Server

Masseb974 · Published 2025-02-16 · Updated 2025-03-21 · CVE-2024-57971

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Knowage Server versions prior to 8.1.30

Description The issue arises from the DataSourceResource.java in the SpagoBI API support, which does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name. This could allow an authenticated attacker with high privileges to manipulate JNDI resource identifiers.

Recommendations For versions prior to 8.1.30, update to version 8.1.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the SpagoBI API support to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-99

Related Identifiers

CVE-2024-57971

Affected Products

Knowage Server

References · 12

• 🔥 https://github.com/darumaseye/CVEs/blob/ec2de9f7ecffde466e687745bfdfc672e86241d7/CVE-2024-57971.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-57971 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57971 · Security Note
• https://github.com/KnowageLabs/Knowage-Server/commit/f7d0362f737e1b0db1cc9cc95b1236d62d83dd0c · Note
• https://github.com/KnowageLabs/Knowage-Server/compare/v8.1.29...v8.1.30 · Note
• https://t.me/thedarkwebinformer/12759 · Telegram Post
• https://twitter.com/DarkWebInformer/status/1891205819565482117 · Twitter Post
• https://t.me/cvedetector/18180 · Telegram Post
• https://spagobi.readthedocs.io · Note
• https://t.me/cvenotify/111505 · Telegram Post
• https://twitter.com/CVEnew/status/1890978424409223234 · Twitter Post
• https://t.me/cvenotify/115642 · Telegram Post