{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-3140", "assignerOrgId": "296541fb-a0e3-4ca7-ab3d-683e666d143e", "state": "PUBLISHED", "assignerShortName": "KNIME", "dateReserved": "2023-06-07T09:01:00.528Z", "datePublished": "2023-06-07T09:15:00.112Z", "dateUpdated": "2023-06-07T09:15:00.112Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Web Application"], "product": "KNIME Business Hub", "vendor": "KNIME", "versions": [{"lessThan": "1.4.0", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Breachlock"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME\n Business Hub before 1.4.0 has left users vulnerable to click \njacking. Clickjacking is an attack that occurs when an attacker uses a \ntransparent iframe in a window to trick a user into clicking on an \nactionable item, such as a button or link, to another server in which \nthey have an identical webpage. The attacker essentially hijacks the \nuser activity intended for the original server and sends them to the \nother server."}], "value": "Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME\n Business Hub before 1.4.0 has left users vulnerable to click \njacking. Clickjacking is an attack that occurs when an attacker uses a \ntransparent iframe in a window to trick a user into clicking on an \nactionable item, such as a button or link, to another server in which \nthey have an identical webpage. The attacker essentially hijacks the \nuser activity intended for the original server and sends them to the \nother server."}], "impacts": [{"capecId": "CAPEC-103", "descriptions": [{"lang": "en", "value": "CAPEC-103 Clickjacking"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1021", "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "296541fb-a0e3-4ca7-ab3d-683e666d143e", "shortName": "KNIME", "dateUpdated": "2023-06-07T09:15:00.112Z"}, "references": [{"url": "https://www.knime.com/security/advisories#CVE-2023-3140"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to KNIME Business Hub 1.4.0 or later.<br>"}], "value": "Update to KNIME Business Hub 1.4.0 or later.\n"}], "source": {"discovery": "EXTERNAL"}, "title": "KNIME Hub Web Application is vulnerable to clickjacking", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:knime:business_hub:*:*:*:*:*:*:*:*", "matchCriteriaId": "247C553F-E9B6-4371-865B-8677893F5FB3", "versionEndExcluding": "1.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME\n Business Hub before 1.4.0 has left users vulnerable to click \njacking. Clickjacking is an attack that occurs when an attacker uses a \ntransparent iframe in a window to trick a user into clicking on an \nactionable item, such as a button or link, to another server in which \nthey have an identical webpage. The attacker essentially hijacks the \nuser activity intended for the original server and sends them to the \nother server."}], "id": "CVE-2023-3140", "lastModified": "2023-06-16T18:06:57.083", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@knime.com", "type": "Secondary"}]}, "published": "2023-06-07T10:15:09.770", "references": [{"source": "security@knime.com", "tags": ["Vendor Advisory"], "url": "https://www.knime.com/security/advisories#CVE-2023-3140"}], "sourceIdentifier": "security@knime.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1021"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-1021"}], "source": "security@knime.com", "type": "Secondary"}]}

{}