CVE-2023-3140
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before version 1.4.0 has left users vulnerable to clickjacking. This attack tricks users into clicking on actionable items, redirecting them to another server.
Risk Assessment
The organization is at risk of clickjacking attacks, which may lead to unauthorized access to data or unintended actions by users.
Recommendation
It is recommended to update KNIME Business Hub to version 1.4.0 or later and implement appropriate HTTP headers to mitigate the risk.
Original NVD description (English source)
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server.