CVE-2022-39295: Eng Knowage

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4.22, 8.0.9, and 8.1.0 is vulnerable to cross-site scripting because the `XSSRequestWrapper::stripXSS` method can be bypassed. Versions 7.4.22, 8.0.9, and 8.1.0 contain patches for this issue. There are no known workarounds.

Affected products

• Eng Knowage: from 6.1.0, before 7.4.22 (fixed in 7.4.22); from 8.0.0, before 8.0.9 (fixed in 8.0.9)

Published 2022-10-13. Last modified 2026-06-17.