PT-2021-24156 · Knime · Knime Server

Dawid Czarnecki · CVE-2021-44726 · Published 2021-12-08 · Updated 2023-09-28

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AC:L/AV:N/A:L/C:H/I:L/PR:N/S:C/UI:R

Name of the Vulnerable Software and Affected Versions: KNIME Server versions prior to 4.13.4

Description: The issue allows for XSS via the old WebPortal login page.

Recommendations: For versions prior to 4.13.4, update to version 4.13.4 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-44726

Affected Products

Knime Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-44726 · Security Note
• https://docs.knime.com/2021-06/server_update_guide/index.html#_bugfixes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44726 · Vendor Advisory
• https://t.me/cvenotify/24389 · Telegram Post
• https://zigrin.com/advisories/knime-server-dom-based-xss-in-a-login-panel · Note