Wiz
Vulnerability DatabaseCVE-2021-44726

CVE-2021-44726: 
KNIME server vulnerability analysis and mitigation

Overview

KNIME Server before version 4.13.4 contains a DOM-based Cross-Site Scripting (XSS) vulnerability in the old WebPortal login page. The vulnerability was discovered on December 8, 2021 (NVD, Zigrin).

Technical details

The vulnerability is a DOM-based XSS that exists in the login panel of the KNIME Server web application. It can be exploited by creating a specially crafted URL that, when opened by a victim, allows execution of arbitrary JavaScript code in the victim's browser context. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L (Zigrin).

Impact

If successfully exploited, the vulnerability allows an attacker to execute arbitrary JavaScript code in the victim's browser context. When the victim is an administrator, the vulnerability could be used to create new administrator accounts. The attack requires no authentication to exploit, though authenticated users can also be targeted (Zigrin).

Mitigation and workarounds

The vulnerability has been fixed in KNIME Server versions 4.13.4, 4.12.5, and 4.12.6. Users are recommended to update to one of these fixed versions (Zigrin).

Additional resources

Source: This report was generated using AI

Related KNIME server vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2022-44748HIGH7.5
  • KNIME serverKNIME server
  • cpe:2.3:a:knime:knime_server
NoYesNov 24, 2022
CVE-2021-44725HIGH7.5
  • KNIME serverKNIME server
  • cpe:2.3:a:knime:knime_server
NoYesDec 08, 2021
CVE-2021-44726MEDIUM6.1
  • KNIME serverKNIME server
  • cpe:2.3:a:knime:knime_server
NoYesDec 08, 2021
CVE-2021-45097MEDIUM5.5
  • KNIME serverKNIME server
  • cpe:2.3:a:knime:knime_server
NoYesDec 16, 2021

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo