PT-2025-13656 · Knime · Knime Business Hub

Published 2025-03-31 · Updated 2025-04-01 · CVE-2025-2402

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N/AU:Y/R:U/V:C/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions KNIME Business Hub versions prior to 1.10.3 KNIME Business Hub versions prior to 1.11.3 KNIME Business Hub versions prior to 1.12.3 KNIME Business Hub versions prior to 1.13.2

Description A hard-coded, non-random password for the object store (minio) of KNIME Business Hub allows an unauthenticated remote attacker in possession of the password to read and manipulate swapped jobs or read and manipulate in- and output data of active jobs. It is also possible to cause a denial-of-service of most functionality of KNIME Business Hub by writing large amounts of data to the object store directly.

Recommendations Update to version 1.10.3 or later. Update to version 1.11.3 or later. Update to version 1.12.3 or later. Update to version 1.13.2 or later.

Fix

DoS

Weakness Enumeration

CWE-259

Related Identifiers

CVE-2025-2402

GHSA-V5P7-3387-GPMG

Affected Products

Knime Business Hub

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-2402 · Security Note
• https://knime.com/security/advisories#CVE-2025-2402 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-2402 · Vendor Advisory
• https://t.me/cvetracker/20319 · Telegram Post
• https://t.me/cvedetector/21565 · Telegram Post
• https://twitter.com/CveFindCom/status/1906595205752533314 · Twitter Post
• https://twitter.com/CVEnew/status/1906599421405691935 · Twitter Post
• https://twitter.com/syedaquib77/status/1906899166821032239 · Twitter Post
• https://twitter.com/cybercronai/status/1906784055233802340 · Twitter Post
• https://github.com/advisories/GHSA-v5p7-3387-gpmg · Note
• https://t.me/cvenotify/116981 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1906625018613710891 · Twitter Post