What is CVE-2023-3140?

CVE-2023-3140 is a medium-severity vulnerability in Knime Business Hub, classified under Improper Restriction of Rendered UI Layers or Frames (Clickjacking). CVSS score: 4.3/10. Published 2023-06-07.

How severe is CVE-2023-3140?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Knime Business Hub

CVE-2023-3140

Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server.

EPSS: 0.004 (33.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

Affected products

Knime Business_hub
Knime Business Hub — versions 1.0.0

Weakness classification (CWE)

CWE-1021 — Improper Restriction of Rendered UI Layers or Frames (Clickjacking)

References

security@knime.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-3140?: CVE-2023-3140 is a medium-severity vulnerability in Knime Business Hub, classified under Improper Restriction of Rendered UI Layers or Frames (Clickjacking). CVSS score: 4.3/10. Published 2023-06-07.
How severe is CVE-2023-3140?: Medium severity. CVSS v3 base score is 4.3 out of 10.