PT-2025-13669 · Knime+1 · Knime Business Hub+1

Published 2025-03-31 · Updated 2025-04-01 · CVE-2025-3019

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KNIME Business Hub versions prior to 1.12.4 KNIME Business Hub versions prior to 1.13.3

Description The issue is caused by a bug in the widely used nuxt-security module, which leads to cross-site scripting vulnerabilities in KNIME Business Hub's web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary JavaScript may be executed with this user's permissions, potentially resulting in information loss and/or modification of existing data.

Recommendations For versions prior to 1.12.4, update to version 1.12.4 or later. For versions prior to 1.13.3, update to version 1.13.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-3019

Affected Products

Knime Business Hub

Nuxt-Security

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-3019 · Security Note
• https://knime.com/security/advisories#CVE-2025-3019 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-3019 · Vendor Advisory
• https://github.com/Baroshem/nuxt-security · Note
• https://t.me/cvedetector/21564 · Telegram Post
• https://twitter.com/CVEnew/status/1906606378564645149 · Twitter Post
• https://twitter.com/syedaquib77/status/1906899166821032239 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1906619253576405431 · Twitter Post
• https://t.me/cvetracker/20322 · Telegram Post
• https://t.me/cvenotify/116984 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1906622194165117069 · Twitter Post