PT-2023-23297 · Knime · Knime Business Hub

Breachlock · Publicado 2023-06-07 · Atualizado 2023-06-16 · CVE-2023-3140

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions KNIME Business Hub versions prior to 1.4.0

Description The issue is related to missing HTTP headers, specifically X-Frame-Options and Content-Security-Policy, in KNIME Business Hub. This omission leaves users vulnerable to clickjacking attacks. Clickjacking is a type of attack where an attacker uses a transparent iframe to trick a user into clicking on an actionable item, such as a button or link, on a different server that has an identical webpage. The attacker essentially hijacks the user's activity intended for the original server and redirects it to another server.

Recommendations For versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider implementing additional security measures to prevent clickjacking attacks, such as configuring the X-Frame-Options and Content-Security-Policy headers manually. Restrict access to sensitive areas of the application to minimize the risk of exploitation.

Correção

Clickjacking

Enumeração de Fraquezas

CWE-1021

Identificadores relacionados

CVE-2023-3140

Produtos afetados

Knime Business Hub

Referências · 5

• https://knime.com/security/advisories#CVE-2023-3140 · Aviso do Fabricante
• https://t.me/cvenotify/51940 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-3140 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-3140 · Aviso do Fabricante
• https://t.me/cibsecurity/65033 · Publicação no Telegram