Insufficient File Access Controls in KNIME Server from KNIME
CVE-2021-45097

2.9LOW

Key Information:

Vendor

Knime

Status
Knime Server
Vendor
CVE Published:
16 December 2021

What is CVE-2021-45097?

The KNIME Server software exhibits a significant vulnerability where administrator passwords are stored in a file with inadequate access controls. As a result, any local user can potentially access and read these sensitive credentials, leading to unauthorized access and control over the server's functions. This flaw primarily affects installations in unattended mode and underscores the importance of implementing robust file permission settings to protect sensitive information.

References

https://github.com/dawid-czarnecki/public-vulnerabilities...
https://zigrin.com/advisories/knime-server-weak-file-perm...

CVSS V3.1

Score:
2.9
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.