Medium severity · published Sep 1, 2025
CVE-2025-55007
Knowage vulnerable to server-side request forgery
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request forgery. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response, the impact of this vulnerability is limited. However, an attacker could be able to leverage this vulnerability to scan the internal network. This issue has been patched in version 8.1.37.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KN
Knowage-Server · KnowageLabs
< 8.1.37 · source: vendor
KN
Knowage · Eng
before 8.1.37 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55007
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55007
Patch
https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-7f6m-ph57-52w6
More from Knowage-Server
9.8
CVE-2025-59954
Knowage Contains a Remote Code Execution Vulnerability
6.5
CVE-2025-58441
Knowage is vulnerable to blind server-side request forgery (SSRF)
6.1
CVE-2022-39295
Improper Neutralization of Alternate XSS Syntax in Knowage-Server