Vulnerabilities

TI-2023-05120 CVE-2023-5562 · GHSA-4g9c-4jmr-xrqp

Unsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business Hub

LOW 27

An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00353 Published 2023-10-12 Fixed in 5.2.0 CWE-79

TI-2022-22038 CVE-2022-44749 · GHSA-4858-5fjj-3758

Opening workflows from untrusted resources may override arbitrary file system contents

LOW 31

A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being overwritten on the user's system.

CVSS 3.1HIGH 7.0 Local No auth User interaction EPSS 0.00444 Published 2022-11-24 Fixed in 4.5.3, 4.6.4 +1 CWE-22

TI-2022-13425 CVE-2022-31500 · GHSA-9j8c-8637-mccq

In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions.

LOW 33

In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00229 Published 2022-05-31 No fix listed CWE-276

TI-2021-20428 CVE-2021-45096 · GHSA-fgh6-7vq6-4p7f

KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity…

LOW 24

KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.01106 Published 2021-12-16 No fix listed CWE-611

Vulnerabilities

Filters

Unsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business Hub

Opening workflows from untrusted resources may override arbitrary file system contents

In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions.

KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity…