Cross-Site Scripting Vulnerability in KNIME Server by KNIME
CVE-2021-44726

8.8HIGH

Key Information:

Vendor

Knime

Status
Knime Server
Vendor
CVE Published:
8 December 2021

What is CVE-2021-44726?

The KNIME Server prior to version 4.13.4 is susceptible to Cross-Site Scripting (XSS) via the old WebPortal login page. This vulnerability can be exploited by an attacker to inject malicious scripts into the web application, potentially compromising user sessions and leading to unauthorized actions on behalf of users. It is essential for users to upgrade to the latest version to mitigate this risk and maintain web security.

References

https://docs.knime.com/2021-06/server_update_guide/index....
https://zigrin.com/advisories/knime-server-dom-based-xss-...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.