CVE-2021-45096: 
KNIME Analytics Platform vulnerability analysis and mitigation

KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), identified as AP-17730. The vulnerability was discovered and disclosed in December 2021 (NVD, Zigrin Advisory).

The vulnerability allows an attacker to perform XML External Entity (XXE) injection through maliciously crafted workflow files with a .knwf extension. The issue has been assigned a CVSS v3.1 Base Score of 4.7 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, indicating that it requires user interaction but no privileges to exploit (NVD).

When exploited, the vulnerability allows attackers to initiate network connections to attacker-controlled servers and potentially exfiltrate sensitive information such as password hashes from the victim's system. The attack requires the victim to open a specially crafted workflow file (Zigrin Advisory).

The vulnerability has been fixed in KNIME Analytics Platform version 4.5.0. Users are advised to upgrade to this version or later to mitigate the risk. The fix was implemented as part of the AP-17730 issue (KNIME Changelog).