CVE-2023-3140: falha de média gravidade em KNIME Business Hub
KNIME Hub Web Application is vulnerable to clickjacking
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.4%
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME
Business Hub before 1.4.0 has left users vulnerable to click
jacking. Clickjacking is an attack that occurs when an attacker uses a
transparent iframe in a window to trick a user into clicking on an
actionable item, such as a button or link, to another server in which
they have an identical webpage. The attacker essentially hijacks the
user activity intended for the original server and sends them to the
other server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Produtos afetados
KNIME · KNIME Business HubCVEs relacionadas — KNIME Business Hub
No mesmo produto, das mais perigosas para as menos.
CVE-2023-2541MEDIUMSensitive information disclosure in KNIME Hub Web ApplicationEPSS 0.6%CVE-2024-6598HIGHDenial-of-service on KNIME Business Hub when certain jobs are executedEPSS 0.5%CVE-2025-2787HIGHIngress-nginx vulnerability in KNIME Business HubEPSS 0.5%CVE-2026-115517MEDIUMUnrestricted network access between execution contexts in KNIME Business HubEPSS 0.4%CVE-2026-115496MEDIUMWorkflow names may be leaked to unauthenticated users in KNIME Business HubEPSS 0.4%CVE-2025-2402HIGHHard-coded password for object store of KNIME Business HubEPSS 0.4%