CVE-2020-36844
Medium
Description
The KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS. The response has a SCRIPT element that sets window.location.href to a JavaScript URL.
SeverityMedium
CVSS6.1
Exploit probability—
ProductKnowbe4 Security Awareness Training
PublishedApr 20, 2025
First seenApr 20, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- knowbe4 security_awareness_training2020-01-10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| knowbe4 security_awareness_training | v < 2020-01-10 | 2020-01-10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.