PT-2023-23297 · Knime · Knime Business Hub

Breachlock · Published 2023-06-07 · Updated 2023-06-16 · CVE-2023-3140

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions KNIME Business Hub versions prior to 1.4.0

Description The issue is related to missing HTTP headers, specifically X-Frame-Options and Content-Security-Policy, in KNIME Business Hub. This omission leaves users vulnerable to clickjacking attacks. Clickjacking is a type of attack where an attacker uses a transparent iframe to trick a user into clicking on an actionable item, such as a button or link, on a different server that has an identical webpage. The attacker essentially hijacks the user's activity intended for the original server and redirects it to another server.

Recommendations For versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider implementing additional security measures to prevent clickjacking attacks, such as configuring the X-Frame-Options and Content-Security-Policy headers manually. Restrict access to sensitive areas of the application to minimize the risk of exploitation.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2023-3140

Affected Products

Knime Business Hub

References · 5

• https://knime.com/security/advisories#CVE-2023-3140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3140 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3140 · Vendor Advisory
• https://t.me/cvenotify/51940 · Telegram Post
• https://t.me/cibsecurity/65033 · Telegram Post