CVE-2020-36845 — KnowBe4 / Security Awareness Training

CVE-2020-36845

KnowBe4 / Security Awareness Training PUBLISHED

Description (CNA)

The KnowBe4 Security Awareness Training application before 2020-01-10 contains a redirect function that does not validate the destination URL before redirecting. The response has a SCRIPT element that sets window.location.href to an arbitrary https URL.

Affected (CNA)

Vendor / product	Versions
KnowBe4 / Security Awareness Training	affected 0 before 2020-01-10

CWE

CWE-601

References

https://www.doyler.net/security-not-included/knowbe4-vulnerabilities

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.